Comments (3)
Possible solutions?
The first one is obvious, but probably not acceptable. We restrict the usage of SAD:s by banning Proxy-IdP solutions from supporting SADRequest messages.
Next. Can we require that Signature Service to obtain the metadata from the "real" IdP that issued the SAD? And if so, it should be able to verify the signature. But we don't even now if they are in the same federation, so this is not probably the way to go. Furthermore, it will not aid the Signature Service is succeeding with the other checks.
What if we require Proxy-IdP:s wanting to support the SAD/SAP specification to issue a proxy-SAD?
If the Proxy-IdP promises to verify a received SAD (the 8 checks above), it should be able to wrap the original SAD into a Proxy-SAD which can be verified by the Signature Service. The original SAD would still be there for proof. We would need to add an extra field to the seElnSadext
claim - proxiedSad
.
from technical-framework.
SAD verification is done is a tamper resistent environment. It is therefore important that the SAD itself is simple and can be validate using fairly simple process.
I suggest a small change to the specification.
- Add a request ID to the SAD request (SRID).
- Change the "irt" parameter of the SAD to contain the SRID instead of the Authn Request ID.
If a proxy is used, the original SAD request is also proxied to the upstream IdP, preserving the SRID.
Add a new "Proxy section" stating that:
- A proxy IdP may also proxy data that is useful to validate a SAD from an upstream IdP, such as the certificate for the SAD issuer as well as necessary information about attribute and LoA mapping between federations.
- Providing such proxy information described in step 1 is currently outside the scope of this specification.
With these changes, all of the validation steps will pass even if proxy is used.
from technical-framework.
Update after discussion today:
- In addition to the proposal above: Add new request param in SAD request expressing the ID of the requesting signing service.
- The current SAD parameter aud will contain the id of the requesting signing service
- Also add a simple way to proxy the SAD signing certificate from upstream IdP proving the SAD.
from technical-framework.
Related Issues (20)
- Change service entity categories to cover more AuthnContext URI:s
- Make RequesterID RECOMMENDED for Identity Providers HOT 3
- Add new DSS error code for failed user authentication HOT 1
- Setup structure for OpenID Connect specifications
- Re-draw picture in intro
- Signature Activation Protocol (SAP) sign message cleanup HOT 2
- The notBefore and notAfter in SignRequestExtension should be removed
- OAuth 2 Specifications for Sweden Connect HOT 3
- Re-structure main page
- Custom message during authentication HOT 2
- Define attribute to contain id-matching-level HOT 1
- Make changes for the identity matching project
- Write descriptive document about Identity Binding levels and processes
- Update "tekniska anslutningsregler" with new rules for who can sign "Förbetald e-legitimering".
- OIDC: Add claims and scopes specification for Sweden Connect
- Update requirements regarding LoA4
- Update of links in documents needed. HOT 1
- Update Identity Binding document
- Prevent @ from appearing in values used for scoped attributes. HOT 2
- Update meaning of personalIdentityNumberBinding attribute
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from technical-framework.