Our Info Security folks want a new IDP URL

[Cantor, Scott]

On 10/26/18, 9:15 AM, "users on behalf of Losen, Stephen C (scl)" <users-bounces at shibboleth.net on behalf of scl at virginia.edu> wrote:

> That leaves redirect trickery, possibly via F5 iRules.  But I think this is very risky and would be a nightmare to maintain
> and troubleshoot.  I would love to point out at least one technical showstopper to end this debate.

It isn't possible to "just redirect", that would break both POST binding requests and most other requests because of the Destination check in the SAML message. You generally have to proxy (which includes appropriately virtualizing so that the IdP thinks its operating at the URL of the proxy). Most people don't really grasp how to do this correctly (search for the million messages complaining about this with the SP), but it can be done. If you're load balancing at layer 7 you already are so this shouldn't be a big deal for you to handle at a second proxy point.
 
Obviously you can run two IdPs during a transition or do something else intended to be temporary, but it can be many months or work to transition non-metadata-backed software.

As a rule, I now require SPs to either:

- not be broken and use metadata
- provide me an interface to maintain the settings
- guarantee me a < 24 hour response time and contact point to make changes

If they don't actually do the latter, then it breaks, and my customers are told that.

Without that, this URL isn't your key problem, total lack of key revocation is. That is a total breakdown in security and should bother people a lot more than a URL. My auditors have been invaluable in giving me the leverage to do this.

-- Scott