Our Info Security folks want a new IDP URL

[Losen, Stephen C (scl)]

Hi Scott,

Thanks for your thoughts. Good point about key revocation.

By "not be broken and use metadata" do you mean periodically fetch the IDP metadata automatically?  We have many SPs that installed a local copy of our IDP metadata file once and are not configured to refresh. Do you consider this "broken" ?

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, October 26, 2018 9:37 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Our Info Security folks want a new IDP URL

On 10/26/18, 9:15 AM, "users on behalf of Losen, Stephen C (scl)" <users-bounces at shibboleth.net on behalf of scl at virginia.edu> wrote:

> That leaves redirect trickery, possibly via F5 iRules.  But I think this is very risky and would be a nightmare to maintain
> and troubleshoot.  I would love to point out at least one technical showstopper to end this debate.

It isn't possible to "just redirect", that would break both POST binding requests and most other requests because of the Destination check in the SAML message. You generally have to proxy (which includes appropriately virtualizing so that the IdP thinks its operating at the URL of the proxy). Most people don't really grasp how to do this correctly (search for the million messages complaining about this with the SP), but it can be done. If you're load balancing at layer 7 you already are so this shouldn't be a big deal for you to handle at a second proxy point.
 
Obviously you can run two IdPs during a transition or do something else intended to be temporary, but it can be many months or work to transition non-metadata-backed software.

As a rule, I now require SPs to either:

- not be broken and use metadata
- provide me an interface to maintain the settings
- guarantee me a < 24 hour response time and contact point to make changes

If they don't actually do the latter, then it breaks, and my customers are told that.

Without that, this URL isn't your key problem, total lack of key revocation is. That is a total breakdown in security and should bother people a lot more than a URL. My auditors have been invaluable in giving me the leverage to do this.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net