The vulnerability in the Microsoft Office 365 SAML implementation, published last week, dramatically underlines how important it is to handle account federations with due diligence. In the light that such a drastic authentication bypass can happen, not only at a small SaaS and cloud player, but at a provider of the size and importance of […]
cURL and wget – these tools tend to be of great value when a developer starts programming against a new API. With OAuth, you need to get an access token from one API and query another API for the actual data. Seeing the requests at the command line helps understanding the protocols and errors that […]
SAML Integration is easy? If you start to get your hands dirty and undertake the first steps in implementing the standard, you will most likely get an error when running your initial tests. You simply might have missed to import your service provider metadata into the SSOCircle of Trust or have something wrong with the […]
The newspapers “Zeit” and “c’t” revealed that credit cards with new chip-and-pin based security (EMV) can be cloned and used for payments. At first glance very surprising as EMV credit cards are smartcards with crypto graphic measures, which allow a bank to recognize modifications to cards or transaction data. These cards are per se more […]
In this article we compare the SAML service provider implementation of three popular cloud services: Google Apps (which includes GMail, Google Drive and Docs, Calendar) Salesforce SAP Hana Cloud Our testing procedure includes verification of the service provider compliance to the SAML 2.0 specification and checking the handling of signature validations. Abstract: Secure Assertion Markup […]
