AWS Single Sign-On
While this will undoubtedly make a lot of people&#x27;s lives easier, I&#x27;m a bit hesitant to use SAML just yet.<p>SAML is still relatively new, isn&#x27;t very widely used (AFAICT), and I&#x27;m not sure how much security research has been done on the topic thus far.<p>To illustrate, just a few weeks ago there was <i>&quot;a new attack vector discovered that ... enables an attacker to create a ... forged SAML &#x27;authentication object&#x27;, and authenticate across every service that uses SAML 2.0 protocol ...&quot;</i> [0].<p>&gt; <i>In a golden SAML attack, attackers can gain access to any application that supports SAML authentication (e.g. Azure, AWS, vSphere, etc.) with any privileges they desire and be any user on the targeted application (even one that is non-existent in the application in some cases).</i><p>Vulnerabilities like this one really do give up the proverbial &quot;keys to the kingdom&quot; and provide an attacker with pretty much everything they need to <i>really</i> ruin your day.<p>Now, this particular attack isn&#x27;t real practical as it requires things like the &quot;token-signing private key&quot;. You don&#x27;t need domain admin although you do need access to the ADFS account and if an attacker has access to that, well, you&#x27;re probably already screwed (or well on your way). The point is that SAML is still shiny and new and there will almost certainly be additional flaws found in the future -- flaws which may very well compromise you completely.<p>It&#x27;s certainly a nice solution to a big problem and, as I said, will make a lot of people&#x27;s lives easier. I&#x27;m just not yet ready to trust it 100%.<p><i>Edit:</i> To prevent a dozen more &quot;2005!?&quot; comments, I mentioned this in a reply:<p>&gt; <i>True, but it&#x27;s still relatively new to most people, similar to how IPv6 has been around for a few decades but is still &quot;new&quot; to many.</i><p>The spec has been around for a while. Common deployments -- outside of AWS, MS, RH, etc., haven&#x27;t (unless I&#x27;ve just been unaware of them).<p>[0]: <a href="https:&#x2F;&#x2F;www.cyberark.com&#x2F;threat-research-blog&#x2F;golden-saml-newly-discovered-attack-technique-forges-authentication-cloud-apps&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cyberark.com&#x2F;threat-research-blog&#x2F;golden-saml-ne...</a>