Collaborate Disseminate
I have an application that uses SSO and needs to contact an LDAP server to retrieve whether the user exists or not. For that, I thought to use SAML as a means to link the SSO token user information with the LDAP user. However, I don’t real… Continue reading SSO, SAML and LDAP question
Does the SAML Identity Provider have to know which Service Provider the User is trying to authenticate with, during a Single Sign-On?
By looking at the specs, I see references to various elements that to me indicate an affirmative response… Continue reading SAML and privacy: does the Identity Provider have to know about the Service Provider?
I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an SP SAML Endpoint. The SAML IDP returns … Continue reading SAML/oauth2/openid-connect login via proxy as another user
We want to use deeplink with a schema to login using SAML in our Mobile Apps:
i.e
ourschema://host?code=12345
The problem is that other apps on iOS can read the content of ourschema:// including the code parameter.
On Android I think I wi… Continue reading Secure Mobile Deeplink login with SAML (Android, iOS)
How does one defend, detect and deter golden SAML attacks?
Continue reading How does one detect and deter golden SAML attacks?
It wasn’t just the SolarWinds supply-chain hack. There were other ways that the “Russian” hackers broke into countless government agencies and private organizations.
The post Hackers Didn’t Only Use SolarWinds to Break In, Says CISA appeared first on … Continue reading Hackers Didn’t Only Use SolarWinds to Break In, Says CISA
SolarWinds Orion customers have suffered some network compromises according to news reports.
One report says, right at the end of the article, that SAML2.0 signing certificates may have been compromised.
From the point of view of a SAML se… Continue reading SolarWinds Orion SAML compromise mass cert update
Feds are warning that foreign adversaries are exploiting a weeks-old bug in VMware’s Workspace One Access and VMware Identity Manager products. Continue reading NSA Warns: Patched VMware Bug Under Active Exploit
I’m trying to wrap my head around the difference between SAML/OIDC/and OAuth.
Is the only reason SAML is the most popular choice for enterprise SSO that it’s been around much longer? Is it expected to eventually be replaced by OIDC and OAu… Continue reading Why is SAML still used for enterprise SSO instead of OIDC?
I’m new to security concepts. I am studying how SAML works and I’m confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible.
First is when you authenticate to an IDP, the IDP … Continue reading How an IDP sends SAML assertion to an SP?