<div dir="ltr">The post is going trough the user's browser. if someone owns the browser (or the user knows how to use common browser debugging tools like tamper) then they can tamper the http post parameter. this is why you sign messages, so you know the messages weren't tampered with.<div>
<br></div><div style>Marc</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Apr 11, 2013 at 7:26 PM, Peter Spiro <span dir="ltr"><<a href="mailto:pspiro@castlighthealth.com" target="_blank">pspiro@castlighthealth.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="font-family:Calibri,sans-serif;word-wrap:break-word">
<div>Hello SAML mavens,</div>
<div style="font-size:16px"><span style="font-size:18px"><br>
</span></div>
<div style="font-size:16px">I have a SAML security question. </div>
<div style="font-size:16px"><br>
</div>
<div style="font-size:16px">We're a SP supporting IdP-initiated SSO. We have an IdP who would like to send signed SAML responses but convey the user-identifying data as additional https POST parameters rather than including this information within the signed
message.</div>
<div style="font-size:16px"><br>
</div>
<div style="font-size:16px">The IdP feels this would be secure. To me it seems inherently insecure because the identifying information wouldn't be signed, but I'm hard-pressed to imagine a scenario where an attacker could take advantage of it.</div>
<div style="font-size:16px"><br>
</div>
<div style="font-size:16px">Can anyone tell me whether this would be secure, and why? Any informed opinions would be greatly appreciated!</div>
<div style="font-size:16px"><br>
</div>
<div style="font-size:16px"><span style="font-size:medium">
<div style="font-size:16px">(Apologies if this question isn't appropriate for this forum, in which case I'd appreciate recommendations for where to post it.)</div>
<div><br>
</div>
</span></div>
<div style="font-size:16px">Thanks,</div>
<div style="font-size:16px">Peter</div>
<div style="font-size:16px"><br>
</div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>