EsPReSSO - A good morning starts with coffee! In this posts I describe the tool, I wrote for my Bachelor thesis at the Chair for Network and...

On the Security of SAML-based Identity Providers

In previous posts we described Single Sign-On (SSO) and the messages within the authentication flow in detail. Additionally, we showed imple...

Detecting and exploiting XXE in SAML Interfaces

This post will describe some findings, problems and inisghts regarding XML External Entity Attacks (XXEA) that we gathered during a large-sc...

Single Sign-On

Single Sign-On Using authentication via Single Sign-On (SSO) has many advantages over simple Username/Password mechanisms. Wherea...

Verification of SAML Tokens - Traps and Pitfalls

Verification of SAML Tokens - Traps and Pitfalls This post will describe some findings in Single Sign-On area and problems relat...