IdP Initiated SSO

[Cantor, Scott]

>> Also, pro tip: never let anybody embed links to your IdP via this
>> protocol anywhere you don't control.
> 
> You can't really prevent this, can you?

Not rigorously, but I'm not talking about active prevention, more not facilitating it or giving out those links. And to be blunt, when people running IdPs are claiming they can't figure out how to come up with the parameters, I'm not especially worried about my HR developers doing it.

If I really cared, though, I could check my Referer logs, and once in a while I scan them. If I know all such links are supposed to originate from my CGI scripts, it's not hard to find them.

-- Scott