News for hackers. Stuff that matters.

A comment on Sign in as anyone: Bypassing SAML SSO authentication with parser differentials. Parent comment

Re:Sign in as anyone: Bypassing SAML SSO authentication with... by akdor1154 on Saturday March 15, 2025 @09:43PM (#43376397)
My (possibly misunderstood to the point of misphrasing) understanding, is that SAML still has the point-of-difference that your sso provider can cancel a session. Is that right?
[ Parent | on HN ]
Re:Sign in as anyone: Bypassing SAML SSO authentication with... by recursive on Sunday March 16, 2025 @12:14AM (#43376899)
There's an optional feature in the spec I think. But in my very limited experience, it is never implemented or working correctly.
[ Parent | on HN ]
Re:Sign in as anyone: Bypassing SAML SSO authentication with... by p_ing on Sunday March 16, 2025 @09:39AM (#43379009)
Microsoft implements this in Azure/M365.
[ Parent | on HN ]
Re:Sign in as anyone: Bypassing SAML SSO authentication with... by akerl_ on Saturday March 15, 2025 @11:18PM (#43376735)
Can it? In many SAML setups, there's not direct network interaction between the IDP and Service, other than at most sharing metadata via URL.
[ Parent | on HN ]
Re:Sign in as anyone: Bypassing SAML SSO authentication with... by Nextgrid on Saturday March 15, 2025 @10:51PM (#43376637)
OIDC has out-of-band backchannel logout.
[ Parent | on HN ]