Federation Manager Release Notes › New Features in Federation Manager r12.1 SP3 › New Setting to Secure the IdP Discovery Target

Previous Topic: One Time Use of Assertions

Next Topic: Java Server Pages that Check for Cross-site Scripting

New Setting to Secure the IdP Discovery Target

When the Identity Provider Discovery Service receives a request for the common domain cookie, the request includes a query parameter named IPDTarget. To protect the IPDTarget query parameter against attacks, there is a new configuration parameter named ValidFedTargetDomain, which lists all valid domains for your federated environment.

When the IPD Service examines the IPDTarget query parameter, it obtains the domain of the URL specified by the query parameter. The IPD Service compares this domain to the list of domains specified for the ValidFedTargetDomain parameter to confirm it is a legitimate domain.