Multiple and wildcard replyURLs for Relying Parties using WS-Fed about identityserver3.wsfederation HOT 9 OPEN

Identity Server will only send tokens to reply urls it is aware of before the request is made, for security reasons (it minimizes the attack surface). If this url is compromised in some way, an attacker could start stealing tokens and therefore gain unauthorized access your resources. Wildcard urls are too easily manipulated and this is how some big players have been compromised in the past.

Regarding multiple Reply Urls per Relying Party (like in the core project for OIDC), I don't see why not. Unless this is prohibited by the WS-Fed specification in some way... It'd need to be a PR either way.

from identityserver3.wsfederation.

Thank you very much for your feedback. So it means that the IdentityServer support multiple ReplyUrls in theory? Because in the current implementation we saw that the model class RelyingParty does only save one ReplyUrl. Does it mean we need to extend this class?
In the WS-Fed specification the wreply parameter is an optional parameter and is the URL to which responses are directed.

Thanks

from identityserver3.wsfederation.

In theory it is possible to have multiple ReplyUrls, however this requires changes to both the RelyingParty model and SignInValidator (I think). Either way, the change to RelyingParty model is a breaking change.

I could maybe get a PR ready for the v3 release where such breaking changes are acceptable.

from identityserver3.wsfederation.

This PR has support for multiple reply url's for WsFed:
#60

And it was just merged in.

from identityserver3.wsfederation.

Looks like you can also plug-in your own reply validator:
https://github.com/IdentityServer/IdentityServer3.WsFederation/blob/dev/source/WsFederationPlugin/Services/DefaultRedirectUriValidator.cs#L52

So you could put in your own wildcard and implement logic to parse that and satisfy the call.

from identityserver3.wsfederation.

A collection for PostLogoutRedirectUris was added in #60, however the ReplyUrl is still one per Relying Party. Changing this would be a breaking change.

IRedirectUriValidator is also implemented for post logout redirect urls only.

from identityserver3.wsfederation.

Oh, sorry, missed the part where you needed it to be on the ReplyUrl param

from identityserver3.wsfederation.

Hi,
I am quite new in the github community. Sorry for this bad question, but what are the steps if we like to make a breaking change to have one RP with multiple Endpoints?

Thanks

from identityserver3.wsfederation.

We would need to add the feature and release a new major version. We are not planning to do that soon.

from identityserver3.wsfederation.