Google closes hole in Single Sign-On for Google Apps
Google has changed the way its SAML Single Sign-On (SSO) Service for Google Apps works after receiving reports about a security problem Administrators and developers from other providers who use Google's SSO may be forced to revise their Identity Provider for authentication.
According to a report published by a group of security specialists, a flaw in the protocol used allowed a specially prepared server to register with another service when posing as a user.
See also:
- Google SAML Single Sign on vulnerability, Vulnerability Note VU#612636 from US-Cert
- Formal Analysis of SAML 2.0 Web Browser Single Sign-On: Breaking the SAML-based Single Sign-On for Google Apps, Error report from the Artificial Intelligence Laboratory
(trk)