Intermediary handling of identity services to guard against client side attack vectors
This document describes, among other things, security hardening techniques that guard against certain client-side attack vectors. These techniques generally involve the use of an intermediary that detects and handles identity service transactions on behalf of a client. In one embodiment, the intermediary establishes a resource domain session with the client in order to provide the client with desired resource domain content or services from a resource domain host. The intermediary detects when the resource domain host invokes a federated identity service as a condition of client access. The intermediary handles the identity transaction in the identity domain on behalf of the client within the client's resource domain session. Upon successful authentication and/or authorization with an IdP, the intermediary connects the results of the identity services domain transaction to the resource domain.
1. A method performed by an intermediary server, the intermediary server being deployed on a network path in between a client and a host, the host associated with a relying party, the intermediary server being remote from the client, the method comprising:
establishing a secure session on a resource domain with a client;
within the secure session, receiving a request for a resource hosted under the resource domain;
proxying the request for the resource from the client to a relying party (RP) host acting as origin for the resource domain;
intercepting a redirect sent from the RP host to redirect the client from the resource domain to an identity services provider (IdP) domain, said interception performed to prevent the redirect from reaching the client;
in response to intercepting the redirect, prompting the client for a client credential, said prompting occurring within the secure session on the resource domain;
receiving the client credential within the secure session on the resource domain;
independent of the client, performing the following actions:
following the redirect to contact an IdP host on the IdP domain, and providing the client credential to the IdP host to obtain an identity assertion from the IdP host, and
sending the identity assertion to the relying party to obtain therefrom a resource domain credential for the client, the resource domain credential being distinct from the client credential;
once the resource domain credential for the client is obtained, associating the resource domain credential with the secure session on the resource domain between the client and the intermediary server, where said associating comprises any of:
storing the resource domain credential on the intermediary server on behalf of the client, and
storing the resource domain credential on the client under the resource domain;
after said association of the resource domain credential with the resource domain secure session between the client and the intermediary server:
proxying a request from the client to the RP host for the resource and including the resource domain credential with the proxied request.
2. The method of claim 1 , where the associating comprises:
storing the resource domain credential on the intermediary server on behalf of the client.
3. The method of claim 1 , where the associating comprises:
storing the resource domain credential on the client under the resource domain.
4. The method of claim 3 , further comprising performing said storing of the resource domain credential on the client under the resource domain at least by:
within the secure session under the resource domain, sending the client a redirect from the resource domain to the resource domain, and attaching the resource domain credential to said redirect.
5. The method of claim 4 , wherein the resource domain credential is set as a cookie.
6. The method of claim 1 , wherein said prompting the client for the client credential comprises:
renegotiating the secure session with the client.
7. The method of claim 1 , wherein said establishing the secure session on the resource domain with the client comprises: the intermediary server presenting a resource domain certificate to authenticate to the client for serving resources under the resource domain.
8. The method of claim 1 , wherein the intermediary server comprises a reverse proxy server.
9. The method of claim 1 , wherein the secure session comprises a transport layer security (TLS) session.
10. The method of claim 1 , wherein the IdP host comprises a SAML-compliant host and the identity assertion comprises a SAML assertion.
11. An apparatus comprising:
an intermediary server deployed on a network path in between a client and a host, the host associated with a relying party (RP host), the intermediary server deployed remote from the client;
the intermediary server comprising one or more processors and memory holding instructions that when executed on the one or more processors cause the intermediary server to:
establish a secure session on a resource domain with a client;
within the secure session, receive a request for a resource hosted under the resource domain;
proxy the request for the resource from the client to the RP host acting as origin for the resource domain;
intercept a redirect sent from the RP host to redirect the client from the resource domain to an identity services provider (IdP) domain, said interception performed to prevent the redirect from reaching the client;
in response to intercepting the redirect, prompt the client for a client credential, said prompting occurring within the secure session on the resource domain;
receiving the client credential within the secure session on the resource domain;
independent of the client, perform the following actions:
follow the redirect to contact an IdP host on the IdP domain, and providing the client credential to the IdP host to obtain an identity assertion from the IdP host; and
send the identity assertion to the relying party to obtain therefrom a resource domain credential for the client, the resource domain credential being distinct from the client credential;
once the resource domain credential for the client is obtained, associate the resource domain credential with the secure session on the resource domain between the client and the intermediary server, where said associating comprises any of:
store the resource domain credential on the intermediary server on behalf of the client, and
store the resource domain credential on the client under the resource domain;
after said association of the resource domain credential with the resource domain secure session between the client and the intermediary server: proxy a request from the client to the RP host for the resource and including the resource domain credential with the proxied request.
12. The apparatus of claim 11 , where the associating comprises:
storing the resource domain credential on the intermediary server on behalf of the client.
13. The apparatus of claim 11 , where the associating comprises:
storing the resource domain credential on the client under the resource domain.
14. The apparatus of claim 13 , further comprising performing said storing of the resource domain credential on the client under the resource domain at least by:
within the secure session under the resource domain, sending the client a redirect from the resource domain to the resource domain, and attaching the resource domain credential to said redirect.
15. The apparatus of claim 14 , wherein the resource domain credential is set as a cookie.
16. The apparatus of claim 11 , wherein said prompting the client for the client credential comprises:
renegotiating the secure session with the client.
17. The apparatus of claim 11 , wherein said establishing the secure session on the resource domain with the client comprises: the intermediary server presenting a resource domain certificate to authenticate to the client for serving resources under the resource domain.
18. The apparatus of claim 11 , wherein the intermediary server comprises a reverse proxy server.
19. The apparatus of claim 11 , wherein the secure session comprises a transport layer security (TLS) session.
20. The apparatus of claim 11 , wherein the IdP host comprises a SAML-compliant host and the identity assertion comprises a SAML assertion.