How does the SAML Holder-of-Key Web Browser SSO profile bind an assertion to the user's browser?
The browser presents a client certificate in mutually authenticated TLS handshakes with both the IdP and the SP; the IdP puts that certificate's key into a holder-of-key assertion, and the SP accepts it only if the browser proves possession of the same key in its own TLS handshake.
* HoK SSO: the SP compares the certificate in the assertion with the one the browser just used in TLS. *
- The SP redirects the browser with an
<AuthnRequest>as usual. - The browser opens a TLS connection to the IdP with client authentication, presenting its certificate (Cert UA-IdP). The IdP extracts it.
- The IdP authenticates the user and issues a holder-of-key assertion: its subject confirmation method is
holder-of-keyand it contains the client certificate. - The browser delivers the response to the SP over another TLS handshake with client authentication, presenting its certificate again (Cert UA-SP).
- The SP checks Cert UA-IdP = Cert UA-SP and then verifies the assertion as usual.
The certificate may be self-signed: its job is not to identify the user via a PKI, only to provide a key pair whose private half never leaves the browser. A TLS client authentication proves possession of that private key, which is what makes a copied assertion useless.
Go deeper:
OASIS: SAML V2.0 Holder-of-Key Web Browser SSO Profile — the profile itself, including its note that self-signed certificates are allowed.- Mutual authentication (Wikipedia) — how TLS client certificates prove key possession.