Lab: Build a SAML SSO Test Environment (SimpleSAMLphp)

#Constructing the Identity Bridge#link

SAML is complex to implement from scratch. In this lab, you will use SimpleSAMLphp to deploy both an Identity Provider (IdP) and a Service Provider (SP) on a single server, allowing you to analyze the XML assertions in real time.

Phase 1: Environment Setup

First, install the required PHP dependencies and the SimpleSAMLphp library. Configure two virtual hosts: `idp.lab.local` and `sp.lab.local`.

Phase 2: Establishing the Trust Relationship

Navigate to the IdP administration panel, export the metadata XML, and import it into the SP. Then export the SP metadata and import it into the IdP.

<!-- Example Metadata Snippet -->
<EntityDescriptor entityID="https://idp.lab.local/simplesaml/saml2/idp/metadata.php">
  <IDPSSODescriptor>
    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
      Location="https://idp.lab.local/simplesaml/sso" />
  </IDPSSODescriptor>
</EntityDescriptor>

This metadata exchange tells the SP where to send users for authentication and how to verify assertions signed by the IdP.

Phase 3: Testing the SSO Flow

After authenticating at the IdP, you will be redirected back to the SP. Use your browser's developer tools to inspect the POST request containing the `SAMLResponse`.

The Breaking Phase: Assertion Tampering

Using a proxy tool, intercept the `SAMLResponse` before it reaches the SP. Decode the response and inspect the assertion structure. Observe how signature validation protects the integrity of the message.

• ▪Capture the POST request
• ▪Decode the Base64-encoded SAMLResponse
• ▪Inspect the XML assertion structure
• ▪Re-encode and forward the request