Liberty ID-FF Bindings and Profiles Specification - Liberty Alliance

Liberty Alliance Project:Liberty ID-FF Bindings and Profiles SpecificationVersion: 1.2-errata-v2.0228322842285228622872288228922902291229222932294229522962297229822992300230123022303an active session before issuing an without first authenticating the Principal. Cookies posted byidentity providers MAY be used to support this validation process, though Liberty does not mandate a cookie-basedapproach.4.4.2.2. Liberty-Enabled Client and Proxy ProfileThreat: Intercepted and and subsequent Principal impersonation.Description: A spurious system entity can interject itself as a man-in-the-middle (MITM) between the user agent(LECP) and a legitimate service provider, where it acts in the service provider role in interactions with theLECP, and in the user agent role in interactions with the legitimate service provider. In this way, as a first step,the MITM is able to intercept the service provider’s (step 3 of Section 3.2.4)and substitute any URL of its choosing for the value before forwardingthe on to the LECP. Typically, the MITM will insert a URL value thatpoints back to itself. Then, if the LECP subsequently receives a from theidentity provider (step 6 in Section 3.2.4) and subsequently sends the contained to the received from the MITM, the MITM will be able to masquerade as thePrincipal at the legitimate service provider.Countermeasure: The identity provider specifies to the LECP the address to which the LECPmust send the . The in the element is for this purpose. This URL value is among the metadata thatidentity and service providers must exchange in the process of establishing their operational relationship (seeSection 3.1 and Section 3.1.3).23042305230623072308230923102311231223132314231523162317231823192320232123224.4.2.3. FederationThreat: Collusion among service providers can violate privacy of the PrincipalDescription: When a group of service providers collude to share the of aPrincipal, they can track and in general compromise the privacy of the principal. More generally, this threat exists forany common data (e.g. phone number) shared by rogue system entities.Countermeasure: The is required to be unique for each identity provider toservice provider relationship. However, this requirement does not eliminate the threat when there are rogue participantsunder the Principal’s identity federation. The only protection is for Principals to be cautious when they choose serviceproviders and understand their privacy policies.Threat: Poorly generated name identifiers may compromise privacyDescription: The federation protocol mandates that the elements be unique within aPrincipal’s federated identities. The name identifiers exchanged are pseudonyms and, to maintain the privacy ofthe Principal, should be resistant to guessing or derivation attacks.Countermeasure: Name identifiers should be constructed using pseudo-random values that have no discernablecorrespondence with the Principal’s identifier (or name) used by the entity that generates the name identifier.4.4.3. Name RegistrationNo known threats.4.4.4. Federation Termination: HTTP-Redirect-Based ProfileThreat: Attacker can monitor and disrupt terminationLiberty Alliance Project67