Definition
In SAML, an identity provider issues a signed assertion and a service provider accepts it as proof of identity. Forgery becomes possible when the service provider's validation is incomplete, either of that signature or of what the signature actually covers.
Where validation typically weakens
- Signature verification that does not cover the elements being trusted
- Acceptance of assertions from an unintended or unpinned issuer
- Insufficient handling of document structure and canonicalization
- Missing validation of audience, recipient, timing or replay conditions
Why the consequence is disproportionate
Enterprise SSO is deliberately a central trust point. An accepted forged assertion does not merely authenticate a session. It can assert a role, a group membership or an administrative identity, and it does so through the mechanism the organization built specifically to be trusted.
- Attacker
- Forged Assertion
- SaaS / Application
- Privileged Identity
- Sensitive Data
Each hop validated by successful exploitation
Tags
- saml
- sso
- authentication