Best Practices

SAML security best practices

The Security Assertion Markup Language (SAML) is an open standard for exchanging authorization and authentication information. In this document, we'll discuss some best practices that ensure sensitive information within the SAML Assertion is transmitted securely between ADSelfService Plus and a service provider (SP).

1. Update to the latest version of ADSelfService Plus: Update your ADSelfService Plus instance to the latest version.
2. Validate message confidentiality and usage: Refrain from using SSL v2, SSL v3. and TLS v1 protocols. Implement TLS 1.2 to guarantee message confidentiality and integrity at the transport layer. It will help ward off attacks like:
   • Eavesdropping
   • Theft of User Authentication Information
   • Theft of the Bearer Token
   • Message Deletion
   • Message Modification
   • Man-in-the-middle
3. Additional countermeasures: Ensure that you enforce:
   1. IP Filtering to counter:
      • Stolen assertion
      • Man-in-the-middle attacks
   2. OneTimeUse on the SAML Response to counter:
      • Browser State Exposure
      • Replay

IdP considerations

1. Generate SAML tokens after validating identities with strong authentication options.
2. Synchronize to a common Internet time source.
3. Define levels of assurance for identity verification.
4. Choose asymmetric identifiers for identity assertions over personally identifiable information.
5. Sign the entire response element or each individual assertion.
6. Implement SHA-256 algorithm if supported by the SP.
7. To prevent attackers from changing the embedded username in the SAML assertion, incorporate a signature within their SAML responses to prevent hackers from tampering with the assertions.

   <saml:Signature>
   ......
   <saml:SignatureValue>
   dXNlcjE=
   </saml:SignatureValue>
   ......
   </saml:Signature>
   ......
   <saml:AttributeStatement>
   <saml:Attribute Name="abc">
   <saml:AttributeValue>
   victim_user
   </saml:AttributeValue>
   </saml:Attribute>
   </saml:AttributeStatement>

8. To prevent web attacks like SQL injection, stored-XSS, and XXE, the SAML messages should be sanitized before being used.

Note: Validate X.509 Certificate for export restrictions, algorithm compatibility, and encryption strength.

ADSelfService Plus as SP considerations: