Collaborate Disseminate
We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN for that use-case for multiple reasons… Continue reading SSO Log Users Out Based on IP Address
I was reading about Shibboleth’s metadata — https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata#Metadata-Use(andnon-use)ofMetadata , and how it’s used to identify IDPs and service providers involved in the SAML f… Continue reading If only SP (or IDP) uses Shibboleth in its SAML implementation, can the systems still communicate?
I’m trying to understand the benefits of encrypting assertions in SAML requests, especially if those requests travel over SSL. As I have read, this isn’t required. After authentication, if a service provider requests inform… Continue reading Is there a SAML scenario where you would need an encrypted assertion if you are using SSL?
I am looking for some recommendation / advice, with the following scenario:
Using apache 2.4 and Shib 2.
The setup is SP initiated.
Only one Apache web server
I am protecting two resources.
example.com/siteA
example.com/… Continue reading Shibboleth SP two resources and two IDPs
I have a SaaS app (App), and it has established SAML trust relationships with two of our clients, Acme and Foo.
Acme users log in to App through an IdP-initiated flow. Foo users also log in to App through an IdP-initiated fl… Continue reading SAML Security Question
I have a scenario in mind and I am wondering if this is, in general, a drawback to SSO using SAML 2.0/OIDC or if there are any known ways to mitigate such a scenario:
Background:
1. A user is able to SSO into some remote app… Continue reading SSO using SAML 2.0/OIDC
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application’s host 4000+ parent and student records including medical records so secu… Continue reading Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?
I want to force reauthentication when a user signs a document using ForceAuthn and RequestedAuthnContext / AuthnContextClassRef (to bypass browser caching authentication) in the SAML request. Is it a good idea to save the au… Continue reading Save SAML AuthnContextClassRef at login and use when signing?
I am working with a company that has product that supports SAML based authentication.
We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the user must already exist i… Continue reading SAML assertion encryption and using same key for encryption as signing
I’m currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider.
I’m not too familiar with SAML, but during the authentication, the sent SAMLRequest states SigAlg=http%3A%2F%2F… Continue reading SHA1 signature in a SAML request