The original post: /r/cybersecurity by /u/NormalClothes6110 on 2024-11-22 07:10:33.

I have a situation in which we(IDP) have a SAML sso setup with a third party service provider application some of our users use. This service provider, which I can’t name as I don’t believe it’s been made public yet, is under going some kind of ransom ware/cyber attack. Is there any possible attack vector or risk for us specifically in regards to sso since we have SAML sso setup with their application? Should we disable the SSO setup from our side until they resolve things or is there really no need for that? Tried searching online for and couldn’t rely find anything apart from the typical SAML attacks.