Dive deep into the intricacies of SAML protocol security in this 40-minute conference talk from nullcon Goa 2014. Explore the critical role of Security Assertion Markup Language (SAML) in single sign-on (SSO) systems and its importance in exchanging authentication and authorization data. Examine potential vulnerabilities in SAML implementations, including XML signature-related attacks like Signature Exclusion and Signature Wrapping (XSW). Learn about the necessity of secure implementation and fuzz testing of SAML attributes. Discover approaches to asynchronously fuzz SAML assertions for identifying issues in proprietary implementations. Cover topics such as cloud applications, federation, SAML components, web services, transport-level SSL, real-world attacks, and methods for securing SAML against various threats.
O'Dea Assertions Untwining the Security of the SAML Protocol
Overview
Syllabus
Introduction
Cloud Applications
Multiple User Names
What happened
What is SAML
What is Federation
Single Sign On
SAML Components
Who
Sample desertion
Assertions
Request response
Web services
Alternative to Web services
Security of SAML
Authentication
Transport Level SSL
Real Attacks
External Signature
Signature Wrapping Attacks
Stack Overflow
Vulnerabilities
SAML PHP
SAML complications
canonicalization entity expansion
design service attacks
attributes
Securing SAML
Signature Roughing Attacks
Taught by
nullcon
