⬇ Download holy card: ·
Blessed Silver SAML, Younger Brother of Gold
Patron of imported signing certificates, Entra ID, and private keys left lying around.
Life
On 29 February 2024, a rare day for a rare flaw, Semperis presented Silver SAML. Like the more famous Golden SAML, it let an attacker forge SAML responses and access applications as any user; this time the target was applications in Entra ID that use a signing certificate generated elsewhere and imported. Whoever stole that private key could sign their own pass.
Prayer
O Blessed Silver SAML, who signs passes with someone else's key, keep our private keys private. Amen.
How to celebrate
Celebrated by using certificates generated by Entra ID instead of importing them, and only in leap years.
Lend your signing key, and you lend your name.