<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello</p>
<p>we have a Service Provider who asked us not to encrypt SAML
assertion in order for the SSO workflow to succeed</p>
<p>as discribed in :
<a class="moz-txt-link-freetext" href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631697/SecurityConfiguration">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631697/SecurityConfiguration</a></p>
<p><span data-code-lang="xml" data-ds--code--code-block=""
class="prismjs cc-1j55rvq"><code class="language-xml"
style="white-space: pre;"><span
class="token tag token tag token punctuation"><</span><span
class="token tag token tag">bean</span><span class="token tag"> </span><span
class="token tag token attr-name">parent</span><span
class="token tag token attr-value token punctuation attr-equals">=</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag token attr-value">RelyingPartyByName</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag"> </span><span
class="token tag token attr-name token namespace">c:</span><span
class="token tag token attr-name">relyingPartyIds</span><span
class="token tag token attr-value token punctuation attr-equals">=</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag token attr-value"><a class="moz-txt-link-freetext" href="https://sp.example.org">https://sp.example.org</a></span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag token punctuation">></span><span class="">
</span></code></span><span data-code-lang="xml"
data-ds--code--code-block="" class="prismjs cc-1j55rvq"><code
class="language-xml" style="white-space: pre;"><span class=""> </span><span
class="token tag token tag token punctuation"><</span><span
class="token tag token tag">property</span><span
class="token tag"> </span><span
class="token tag token attr-name">name</span><span
class="token tag token attr-value token punctuation attr-equals">=</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag token attr-value">profileConfigurations</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag token punctuation">></span><span class="">
</span></code></span><span data-code-lang="xml"
data-ds--code--code-block="" class="prismjs cc-1j55rvq"><code
class="language-xml" style="white-space: pre;"><span class=""> </span><span
class="token tag token tag token punctuation"><</span><span
class="token tag token tag">list</span><span
class="token tag token punctuation">></span><span class="">
</span></code></span><span data-code-lang="xml"
data-ds--code--code-block="" class="prismjs cc-1j55rvq"><code
class="language-xml" style="white-space: pre;"><span class=""> </span><span
class="token tag token tag token punctuation"><</span><span
class="token tag token tag">bean</span><span class="token tag"> </span><span
class="token tag token attr-name">parent</span><span
class="token tag token attr-value token punctuation attr-equals">=</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag token attr-value">SAML2.SSO</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag"> </span><span
class="token tag token attr-name token namespace">p:</span><span
class="token tag token attr-name">signAssertions</span><span
class="token tag token attr-value token punctuation attr-equals">=</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag token attr-value">true</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag"> </span><span
class="token tag token attr-name token namespace">p:</span><span
class="token tag token attr-name">encryptAssertions</span><span
class="token tag token attr-value token punctuation attr-equals">=</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag token attr-value">false</span><span
class="token tag token attr-value token punctuation">"</span><span
class="token tag"> </span><span
class="token tag token punctuation">/></span></code></span></p>
<p></p>
<p>and indeed SSO + attributes (authN+Z) works fine.</p>
<p>However there is a serious security hack possible in that case,
we can intercept the http flows with BURP as a proxy acting as a
Man In The Middle <br>
</p>
<p>by removing the signature xml elements in the final SAML success
login assertion and changing nameID of the user who just
connected (me for example), with the target user uid, enables us
to impersonate that target uid . Finally I am connected as the
targeted user without knowing its password :-( <br>
</p>
<p>where did we missed something ?</p>
<p>1) on the IDP (4) => force signed assertions , what is the
default behaviour, where is it set ?<br>
</p>
<p>2) in the Metadata of the SP (<i><font size="2"><b> </b>WantAssertionsSigned="true")
<b><br>
</b></font></i></p>
<p>3) in the SP code implementation, it should verifiy the signature
and hence sees that the NameID value modification by the MITM
broke the signature. <br>
</p>
<p>4) a combination or all of 1), 2), 3) must be done ? <br>
</p>
<p>Moreover, which certificate should sign ? </p>
<p>A) it it up to the IDP to sign SAML with it's private key and SPs
readding the IDP public key (from emtadata) verify the signature</p>
<p>B) or the IDP sign the assertion with the public key of the SP
(from metadata again) and verify with it's private key ? <br>
</p>
<p>finnaly it is safe not to encrypt SAML assertions as long a
signatures are well verified ? <br>
</p>
<p>Thanks for your help .</p>
<p>Regards .</p>
<p>jehan .<br>
</p>
</body>
</html>