OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

security-services message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]

Subject: Request for failure reason in SAML responses

This is my formal request to add the failure reason to SAML responses that I mentioned at F2F #4. The failure reason would be a string included, at the option of the SAML server, in responses with StatusCode values other than Success. The reason is merely advice to the SAML client as to why the request did not succeed, and the client should (must?) only report the reason to its user or log it in a log file.

I suggest adding the reason as an attribute of ResponseType;: in draft-sstc-scheme-protocol-15.xsd:

 <xsd:complexType name="ResponseType">
   <xsd:extension base="samlp:ResponseAbstractType">
     <xsd:element ref="saml:Assertion" minOccurs="0" maxOccurs="unbounded"/>
    <xsd:attribute name="StatusCode" type="samlp:StatusCodeType" use="required"/>
    <xsd:attribute name="Reason" type="string" use="optional"/>

Usage examples:

<SAMLResponse ResponseID="{uuid-like-thing}"
 MajorVersion="1" MinorVersion="0"
 Reason="SAML Server could not connect to its database: ODBC error something..."/>

<SAMLResponse ResponseID="{uuid-like-thing}"
 MajorVersion="1" MinorVersion="0"
 Reason="Artifact type code 0xffff not supported"/>

Security consideration:
Care should be taken by SAML implementators and deployers not to reveal information about the state of a deployment or a request that could be exploited by an attacker (Bob's "Hints to the Attacker" from F2F #3). A SAML site might turn on reason reporting during initial deployment and testing to help shake out configuration problems, and then turn off reason reporting for production.

adr:;;18922 Forge Drive;Cupertino;CA;95014;USA
title:Principal Software Engineer
fn:Charles Knouse

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [Elist Home]

Powered by eList eXpress LLC