Tag archive
How SAML works: the identity provider signs an XML assertion and hides the signature inside it. That is why XML signature wrapping bugs keep coming back.
Enterprise SSO is a federation of trust, not one shared login session. SAML or OIDC carries identity proof, while each application still owns its session and authorization.
Add SAML 2.0 single sign-on to a Java application with pac4j and Spring Boot: keystore, IdP metadata, SP metadata exchange, user attributes and single logout.
A SAML parsing overflow in the NetScaler packet engine was first described as a crash, and follow-up analysis showed pre-authentication code execution.
We read our own auth server the way an attacker would and wrote the result up: sixteen numbered sections, every finding with a severity, from SAML through SCIM, the admin API and the backup tooling. The eight worst were fixed in one evening, and the test suite reported 367 of 367 passing before that evening and 367 of 367 after. They were not eight unrelated bugs. They were three habits, repeated across subsystems.
Add SAML 2.0 single sign-on to a Play 3 Framework Java application with pac4j: sbt dependencies, keystore, Guice module, routes, @Secure actions and logout.
Learn how SAML 2.0 enables Enterprise Single Sign-On, how IdPs and SPs communicate, what a SAML...
portswigger-c9708498.webp alt: Configuring SAML SSO with Okta - PortSwigger relative:...
OIDC oder SAML? Sie haben selten die Wahl. Was jedes Protokoll ist, wann welches gewinnt, die XML-Signatur-Fallstricke, die SAML gefährlich zum Selbstbauen machen, und warum ein B2B-Produkt am Ende beide braucht.
OIDC ou SAML ? Vous avez rarement le choix. Ce qu'est chaque protocole, quand chacun l'emporte, les pièges de signature XML qui rendent SAML dangereux à implémenter soi-même, et pourquoi un produit B2B finit par avoir besoin des deux.
OIDC 还是 SAML？你很少有选择权。两种协议各自是什么、各自在什么场景下胜出、让 SAML 难以自行实现的 XML 签名陷阱，以及为什么一款 B2B 产品最终两者都需要。
Installing Terraform Enterprise FDO on EKS behind ArgoCD and cdk8s looks straightforward until TLS certs, Traefik, and SAML bootstrap each throw a silent failure with no obvious cause.