Giters

RUB-NDS / PrOfESSOS

PrOfESSOS is our open source implementation for fully automated Evaluation-as-a-Service for SSO. PrOfESSOS introduces a generic approach to improve the security of OpenID Connect implementations by systematically detecting vulnerabilities.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Testing RP only supporting a single OP

bellgrim opened this issue · comments

commented

I am testing a RP that can only be configured with a single OP. So there is no support for webfinger or similar and it will redirect to the OP directly.

It is still useful to test with PrOfESSOS as you can run the following test cases:

  • Replay Attack 1 - 6
  • Signature Manipulation 1 - 2
  • CSRF 1 - 3
  • TRC 1 - 2

Perhaps you could add an option in the controller if you are testing a RP that supports single or multiple OP?

I now had to disable the following code to make it work:

  • waitForPageLoad in the run method of DefaultRPTestBrowser
  • The learning step for honest OP in the run method of RPLearningBrowser
  • waitForPageLoad in the run method of RPLearningBrowser
commented

Thanks. This is a very valuable input. We did not consider this issue till now.