Sigurnost protokola za jedinstvenu prijavu zasnovanih na standardu SAML 2.0

master's thesis

• Title (english): Security of single sign-on protocol based on the SAML 2.0 standard
• Author: Marino Rabuzin
• Mentor: Ante Đerek (mentor)
• Committee member: Ante Đerek (predsjednik povjerenstva)
• Committee member: Stjepan Groš (član povjerenstva)
• Committee member: Leonardo Jelenković (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2023-07-04, Croatia

Abstract

U diplomskom radu detaljno je opisana funckionalnost SAML 2.0 protokola, sa svim njegovim entitetima. Opisani su mogući napadi na sustav koji implementira SAML 2.0 protokol. Ispitana je sigurnost dviju besplatnih i javno dostupnih implementacija SAML 2.0 protokola, izvršavanjem opisanih napada pomoću alata Burp Suite. Također u diplomskom radu je opisan proces vlastite implementacije SAML 2.0 protokola pomoću LemonLDAP:.NG sustava. Pod implementacijom smatra se integracija dva različita vanjska pružatelja identiteta (Keycloak i Auth0) i dva pružatelja usluga u LemonLDAP::NG sustavu.

Abstract (english)

The thesis describes in detail the functionality of the SAML 2.0 protocol, with all its entities. Possible attacks on a system implementing the SAML 2.0 protocol are described. The security of two free and publicly available implementations of the SAML 2.0 protocol were tested by executing the described attacks using the Burp Suite tool. The thesis also describes the process of self-implementation of the SAML 2.0 protocol using the LemonLDAP:.NG system. Implementation means the integration of two different external identity providers (Keycloak and Auth0) and two service providers in the LemonLDAP::NG system.

• Keywords: SAML 2.0; SAML; LemonLDAP::NG; Keycloak; Auth0; Shibboleth; JOSSO; Burp Suite; XML; XSW; XXE; XSLT; Napad izostavljanjem XML potpisa; Napad lažiranjem certifikata; Penetracijsko testiranje
• Keywords (english): SAML 2.0; SAML; LemonLDAP::NG; Keycloak; Auth0; Shibboleth; JOSSO; Burp Suite; XML; XSW; XXE; XSLT; XML Signature Exlusion; Certificate faking; Penetration testing
• Language: croatian
• URN:NBN: urn:nbn:hr:168:289373
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-10-11 10:16:09