sign and/or encrypt SAML assetions, hack MITM

[jehan.procaccia at tem-tsp.eu]

On 21/02/2024 16:57, Peter Schober via users wrote:
> Morgan, Andrew J via users <users at shibboleth.net> [2024-02-21 16:20 CET]:
>> If you are able to modify the assertion without the SP rejecting it,
>> then that SP is not validating the signature.  Personally, I would
>> not use SAML with an SP that does not validate the signature.  As
>> you have found, anyone can modify the assertion to impersonate
>> another user - critical security bug.  Have you reported this issue
>> to the vendor's security contact?
Yes Morgan, we have reported the flow to the vendor, and are activelly 
working on a correction . That's why I search for best-practice Doc  on 
how to instruct them to do the right thinks, any pointer to that will be 
greatly appreciated .
> Testing for this on a larger scale isn't trivial (and might include
> legal aspects) but an activity within GÉANT has recently started to
> look into this:
> https://wiki.geant.org/display/GWP5/Scalable+testing+for+insecure+SAML+signature+validation
>
Thanks again Peter for that link, it describe my problem, even more , it 
focuses on properly validate the signature.

in my case it is worst, there is no signature check at all, I'll care 
about the authenticity of the signature in the second step .

regards , jehan .

>
> -peter