Authentication Sso Session Management

The agent has generated a valid AuthnRequest (ID '_req_7f3a2b') and stored that ID in shared session state. Before any IdP response arrives, a test harness (or attacker proxy) delivers a SAMLResponse to the ACS endpoint with the …

The ACS handler rejects the SAMLResponse before any session record is written. The HTTP response is a 4xx error (not a redirect into the app). The error message explicitly references the missing InResponseTo attribute in terms an IT admin can act on. No session token is issued. The rejection event …

An attacker crafts a SAMLResponse containing two Assertion elements. The first Assertion (document position 0) is unsigned and carries NameID='attacker@external.example' with role attributes granting admin-level access. The secon…

ACS handler resolves the signature Reference URI '#_assert_legit' to the correct DOM element, verifies the signature over that element, and either (a) creates a session attributed to 'alice.chen@hwle.com' with associate-level roles, rejecting any attributes from the unsigned assertion, or (b) rejec…

A valid, properly signed RSA-SHA256 SAMLResponse is generated with NotBefore set to (current_server_time + 1 second) — i.e., the assertion is 1 second in the future from Legora's perspective. The Legora server and the test harnes…

ACS handler evaluates: current_time (T) < NotBefore (T+1s) → assertion not yet valid → reject. HTTP 4xx. No session created. Error message is user-actionable: indicates the assertion is not yet valid and includes the NotBefore timestamp so the IT admin or user can understand the timing issue. Error…