Search code examples
samlsaml-2.0signatureassertionxml-signature

In SAML Response should we sign Response or Assertion

When returning SAML Response to SP, most IdP like AzureAD, Okta, Onelogin, GSuite have the following options about signature:

  • sign Response
  • sign Assertion
  • sign Response and Assertion

And without any configuration, for most IdP, the default for signature is to only sign Assertion.

Below is a SAML Response example from AzureAD (the default signing option is sign Assertion). The Assertion is integrity protected and no tampering can be done. However fields other than Assertion, Destination InResponseTo Issuer, can be tampered with, or add/remove without knowledge!

enter image description here

So my question is:

  1. Why there are 3 kinds of signing? (Response, Assertion, Response & Assertion)
  2. In which use case should we choose to sign the whole Response, sign the Assertion or sign both Response and Assertion?
  3. By only signing Assertion (as default by most IdP), do we exposed to any vulnerabilities?
Solution

  • Check Scott's answer from the SOF post

    The only requirement for the IdP following the SAML 2.0 spec is to digitally sign the Assertion (see http://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf section 4.1.3.5). That is enough to tell if the SSO operation from an IdP should be trusted by SP that has federated with it.

    Signing the outer Response is optional. There are some security benefits to it, such as preventing Message Insertion or Modification (see sections 6.1.3/6.1.5 in http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf) - but in practice it's often omitted in lieu of relying on SSL/TLS.