SAML SSO Security
How does the relying party trust what is being asserted to it? In addition, what prevents a “man-in-the-middle” attack that might grab assertions to be illicitly “replayed” at a later date? These and many more security considerations are discussed in detail in the SAML Security and Privacy Considerations specification [SAMLSec].
SAML allows for message integrity by supporting XML digital signatures in request/response messages.
SAML suports public key exchange either out of band or included in request/response messages.
If additional message privacy is needed, SAML supports sending request/response messages over SSL 3.0 or TLS 1.0. There are other security features that should be covered here such as the security levels of the different bindings, and the fact that both the IDP and SP can create opaque handles to represent the user’s account for privacy issues but this would take alot of energy and time to cover…
[ Security Assertions and Protocol Digest here ]
docs.oasis-open.org
Digg it | Save to del.icio.us | Netscape | Reddit | Stumble It!
- - - - - S P O N S O R I N G A D V E R T I S M E N T - - - - -