Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Security Assertion Markup Language (SAML) is an authentication protocol used throughout corporate environments. It's useful as an SSO solution, but it's also highly complex. This post explains how it can break and why it should be deprecated soon.

In 2002, the Organization for the Advancement of Structured Information Standards (OASIS) Security Services Technical Committee (SSTC) decided to build an XML-based markup protocol for security assertions. Big organizations tend to build the whole kitchen sink at once, which led to four very large contributions from them. Identity providers were important for the modern age of the Internet though.

In 2005, several new attacks on XML integrations started to appear around XML signature wrapping. In 2012, a researcher published an automated testing tool for various types of these attacks. Many implementations of SAML, such as OneLogin, OpenSAML, and others had been vulnerable to at least one variant of signature wrapping attacks. Why can't we fix it then?

SAML is built on XML, which is already shaky from other types of attacks like XXE, and things. XML is extremely complicated compared to JSON; it has the ability to set tags, attributes, elements, doctypes... and so many other things. Complexity is typically at great odds with security. The fact that it's built on XML makes it extremely hard to do properly.

The next issue is around canonicalization. The idea to take a mess of XML, compute a hash of it, and see if it lines up. If the Service Provider (SP), and the Identity Provider (IdP) differ at all, you have a bug. Something may not work. Or, even worse (as with the linked six vulnerabilities relating to this), can be used to perform rounrd-trip attacks to bypass authentication.

From these issues, the author believes that OIDC is the future. It's simpler, built for modern needs, and is safer compared to the issues described above. Overall, a good article on the design of SAML and why it needs to die.