why/how is IdP login page displayed for unknown Service

[Nate Klingenstein]

David,

It's hard to guess exactly what's going on, obviously, but my first hunch is that they are using Salesforce as a proxy to perform a full SAML transaction with your IdP, producing an OAuth token that can be consumed by DemandTools by Validity.  It would be poor security practice on the part of both services to be doing this.

That it's failing is a good thing.  You clearly don't want your login page embedded anywhere.

The only way you'll know for sure is by further interrogating them as to what they're doing, and looking at the actual HTML and HTTP exchanges should be more informative than just looking at the rendered page.

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: IAM David Bantz
Sent: Thursday, July 15 2021, 7:36 pm
To: Shib Users
Subject: why/how is IdP login page displayed for unknown Service

Our IT helpdesk reports failed attempts to login to a service (“DemandTools by Validity”) and provided screen shots of what appears to be our IdP (Shibb v 4.0) login page embedded in a vendor web page. The service is neither federated nor locally (1:1) configured. It seems to piggy-back or otherwise co-opt a different Salesforce service that relies on our IdP. Further confounding me, DemandTools documentation states that SSO is done via OAuth only (https://community.validity.com/customers/s/article/DemandTools-Login-Options <https://community.validity.com/customers/s/article/DemandTools-Login-Options>). How is a non-federated service we’ve never heard of able to get a response from the IdP embedded on their web page, and allegedly allow (OAuth) logins “sometimes” as long as Duo MFA is not invoked?

David St. Pierre Bantz

U Alaska

--

For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net