O'Dea Assertions Untwining the Security of the SAML Protocol
Dive deep into the intricacies of SAML protocol security in this 40-minute conference talk from nullcon Goa 2014. Explore the critical role of Security Assertion Markup Language (SAML) in single sign-on (SSO) systems and its importance in exchanging authentication and authorization data. Examine potential vulnerabilities in SAML implementations, including XML signature-related attacks like Signature Exclusion and Signature Wrapping (XSW). Learn about the necessity of secure implementation and fuzz testing of SAML attributes. Discover approaches to asynchronously fuzz SAML assertions for identifying issues in proprietary implementations. Cover topics such as cloud applications, federation, SAML components, web services, transport-level SSL, real-world attacks, and methods for securing SAML against various threats.