Load balancing and securing SAML in a reverse proxy

[Shavian Shakes <shavian78@gmail.com>]

Hello List, 

We are thinking of implementing "SAML support" in our reverse proxy. The support currently being evaluated :

1. Load balancing SAML to farms of  SPs/IdPs

2. SAML message security as in a XML firewall - preventing against XML DoS and XML Injection attacks. 

As part of #2, I guess we will have to do some or more of the following:

- Import the SP/IdP metadata for XML security and conformance of messages

- Import XML signing and encrypting certs (would this introduce a non-repudiation problem)

For #1:

- Find out the persistency support required, if at all

- Mechanisms to forward SAML SSO tokens to backend apps (?)

Are there any starting documents or references which should we ramping up on which already answer such questions in detail? 

thanks, 

Shavian