http://dl.gi.de/handle/20.500.12116/21001 Wed, 22 Jul 2026 18:54:23 GMT 2026-07-22T18:54:23Z http://dl.gi.de:80/bitstream/id/c7649a4e-5712-4376-91b5-54bc5a766d62/ http://dl.gi.de/handle/20.500.12116/21001 http://dl.gi.de/handle/20.500.12116/1977 Automatic recognition, processing and attacking of single sign-on protocols with burp suite Mainka, Christian; Mladenov, Vladislav; Guenther, Tim; Schwenk, Jörg Hühnlein, Detlef; Roßnagel, Heiko; Kuhlisch, Raik; Ziesing, Jan SAML, Mozilla BrowserID, OpenID, OpenID Connect, Facebook Connect, Microsoft Account, OAuth - today's web applications are supporting a large set of Single Sign-On (SSO) solutions. Some of them have common properties and behavior, others are completely different. This paper will give an overview of modern SSO protocols. We classify them into two groups and show how to distinguish them from each other. We provide EsPReSSO, an open source Burpsuite plugin that identifies SSO protocols automatically in a browser's HTTP traffic and helps penetration testers and security auditors to manipulate SSO flows easily. Thu, 01 Jan 2015 00:00:00 GMT http://dl.gi.de/handle/20.500.12116/1977 2015-01-01T00:00:00Z http://dl.gi.de/handle/20.500.12116/1976 Topology of dynamic metadata exchange via a trusted third party Pöhn, Daniela Hühnlein, Detlef; Roßnagel, Heiko; Kuhlisch, Raik; Ziesing, Jan Federated Identity Management is an effective technology that allows multiple organizations to share resources. Deployments of the protocol Security Assertion Markup Language (SAML) practically require the pre-exchange of aggregated metadata files, making federations to fixed trust boundaries. Dynamic metadata exchange between identity provider and service provider via a trusted third party (TTP) overcomes these barriers. In this paper, we contrast dynamic metadata exchange with other state-of-the-art approaches and present the topology of the dynamic metadata exchange via a TTP. Furthermore, a distributed dynamic metadata exchange is proposed, in order to enhance the current protocol and provide a scalable solution for large-scale infrastructures. Thu, 01 Jan 2015 00:00:00 GMT http://dl.gi.de/handle/20.500.12116/1976 2015-01-01T00:00:00Z http://dl.gi.de/handle/20.500.12116/1978 Evaluating complex identity management systems - the futureid approach Sellung, Rachelle; Roßnagel, Heiko Hühnlein, Detlef; Roßnagel, Heiko; Kuhlisch, Raik; Ziesing, Jan This in-progress paper will discuss the importance of evaluation methods in complex large scale projects, specifically those regarding identity management systems and electronic Identities (eIDs). It will depict the advantages of using a Design Science methodological framework approach and show how the EU project FutureID has utilized this methodology to bring multiple disciplines perspectives together in a harmonized evaluation. Thu, 01 Jan 2015 00:00:00 GMT http://dl.gi.de/handle/20.500.12116/1978 2015-01-01T00:00:00Z http://dl.gi.de/handle/20.500.12116/1970 Open Identity Summit 2015 Hühnlein, Detlef; Roßnagel, Heiko; Kuhlisch, Raik; Ziesing, Jan Thu, 01 Jan 2015 00:00:00 GMT http://dl.gi.de/handle/20.500.12116/1970 2015-01-01T00:00:00Z