SAML and enterprise single sign-on security
You decode SAML flows and assertions, find and close validation gaps such as signature wrapping, unsigned assertions and replay in the service provider, and set up provisioning and SSO event monitoring.
Level 401 · 14 lessons · 12 practice labs
Lessons
Understanding SAML
- SAML actors: identity provider, service provider and user
- SP-initiated and IdP-initiated flows
- Anatomy of an assertion: conditions, audience and signature
- Decoding and inspecting a SAML response with Burp
- Short task: draw the lab SSO flow and mark every checkpoint
SAML mistakes
- Signature wrapping (XSW): the signed element differs from the processed one
- Unsigned assertions and skipped signature checks
- Replay, audience and time checks
- XML parsing risks in SAML: comments and XXE
- Short task: evidence and fix two validation gaps in the service provider
Enterprise identity
- Configuring the SAML library safely
- Provisioning and deprovisioning with SCIM: forgotten accounts
- Monitoring SSO events and catching suspicious sign-ins
- Capstone: audit and harden a SaaS app’s SAML integration
Practice labs
- Decode and read a SAML response: Decode the SAML response in the lab SSO login with Burp and mark the issuer, audience, validity and signature fields.
- Draw the SSO flow: the checkpoints: Draw the service-provider-initiated flow and mark each validation the service provider must perform.
- The risk of the identity-provider-initiated flow: Show the risk on a service provider that accepts unsolicited responses in the lab and require the InResponseTo check.
- Validate the assertion conditions fully: Test which conditions the service provider fails to validate with five faulty assertions and fill the gaps.
- An unsigned assertion is accepted: Prove in the lab that an assertion with its signature removed is accepted and turn on the signature requirement.
- A replayed SAML response: Prove the same response is accepted a second time and make it single-use with an assertion ID cache.
- A service provider with no audience check: Prove an assertion issued for another app is accepted and add audience validation.
- Signature wrapping: the signed and the processed element: Show in the lab that the service provider processes an element other than the signed one and fix it with a setting that binds the library to the signed element.
- Follow SSO events in the log: Match one login across identity provider and service provider logs and list the failed validations.
- An account SCIM never closed: Find an account disabled at the identity provider but still open in the app and fix deprovisioning sync.
- An alert for suspicious SSO logins: Write and test an alert rule that catches suspicious SSO patterns such as a signature error followed by a successful login.
- A SAML integration review of a SaaS app: Review the SAML integration of the fictional Halcyra Payroll app, harden the library settings and retest.
About this course
You decode SAML flows and assertions, find and close validation gaps such as signature wrapping, unsigned assertions and replay in the service provider, and set up provisioning and SSO event monitoring.
What you will learn
- Understanding SAML
- SAML mistakes
- Enterprise identity
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.