Integrating idp3 with cirqlive

[Tom Scavo]

On Mon, Aug 21, 2017 at 9:54 PM, Joseph Fischetti
<Joseph.Fischetti at marist.edu> wrote:
> I've been asked to look into integrating cirqlive with our existing IDP 3
> installation. Cirqlive adds a link between Sakai and webex sso.

Apparently that "link" you speak of is not SAML Web Browser SSO since
CirQlive MEETS is not browser-facing (according to the document you
sent).

> During my
> research I found that cirqlive expects the private key of our IDP so that it
> can sign the assertions that it sends to WebEx.

No rational IdP operator would do that...

> Obvious security concerns aside, when I reached out to cirqlive for
> clarification, I received the following PDF in reply.  It seems that, given
> architecture 1 (page 3), they feel that sharing the idp's private key is
> okay.

Well then they don't understand how SAML works. If they possess a copy
of your private SAML signing key, they could impersonate your IdP at
will. Such a key must be considered compromised.

> They also reference using separate keys for different SPs, which as
> far as im aware, isn't possible with IDP 3.

I don't know about that but for the sake of argument let's suppose
that's possible. You can't publish the corresponding public key
certificate in federation metadata since then you're right back where
you started (i.e., complete compromise). So maintenance of that key is
necessarily out-of-band. For a compromised key, that's bad news.

That's actually the least of your worries. Assuming the private key is
securely transmitted to the 3rd party in the first place, that signing
key is still compromised since the 3rd party can impersonate any of
your users logging into webex. Worse, if they lose control of the
private key, you're right back where you started...complete and utter
compromise.

> Does anybody else have experience with this?

I hope not ;-)

Tom