Sign in as anyone: Bypassing SAML SSO authentication with parser differentials

SAML (more broadly XML-DSIG) is literally the worst security protocol in common use. I think you should generally be taking whatever hits you need to take to transition from it to OAuth. Certainly, I would refuse to bring a new product to market that relied on it. It's incredibly dangerous. Unless there's some breakthrough in practical formal verification, I can't imagine that this will be the last or the worst DSIG vulnerability.

Security Cryptography Whatever’s take on this week SAML non-sense will be fun.

Honestly, hadn't thought of it, but of course we should do that. Thanks!

One day I will write an essay on all of the incredibly stupid things XML DSig does, and that's not even touching the cryptography. It's peak enterprise software brain.

Someone should go deep on the mailing list and standards body horrors of WS-* and OASIS/XACML and all that crap

I’d sub to infosec rant podcasts. $5/mo Patreon sub for a non-vtuber version.

My (possibly misunderstood to the point of misphrasing) understanding, is that SAML still has the point-of-difference that your sso provider can cancel a session. Is that right?

OIDC has out-of-band backchannel logout.

Can it? In many SAML setups, there's not direct network interaction between the IDP and Service, other than at most sharing metadata via URL.

There's an optional feature in the spec I think. But in my very limited experience, it is never implemented or working correctly.

Microsoft implements this in Azure/M365.

Please write about this. I would love to read it.