Sign In

Sixto Pablo Martín García

Technical Program Manager

Sixto García is a highly skilled and experienced web developer, with a focus on PHP, Java, and Python/Django, CMS, database administration, and identity management, including SAML and Single Sign-on. He has worked with Open Source Software for many years and has contributed significantly to several projects, including the SAML PHP Toolkit, Java Toolkit, and Python Toolkit. At OneLogin, he served as a Senior Software Engineer and previously as a Lead Toolkit Developer and SAML Engineer. Sixto's background includes a Bachelor's degree in Computer Science and Software Engineering from the University of Seville. He is also proficient in systems integration, REST APIs, project management, and e-learning.

Highlights

Jun 14 · linkedin

It makes me really sad each time I read about the Golder/Silver SAML attack technique from people/companies working in the "cybersecurity" area.

Private Keys used to sign SAML Messages or to Decrypt SAML elements MUST be managed safely and can't be exposed in any way and protect them should be priority 1. You need to monitor any possible access to them and warn any third party trusting its related public cert if they are compromised. Similar to changing passwords in any system, if you were reusing it (badly done) if your password somehow got leaked.

Do we also need to warn people that if the private key used in HTTPs is exposed, anyone can set an MITM attack and read their traffic?

Wonder what? The "Private" of the "Private Key" means that it needs to be kept secret and should not be exposed. In SAML, it is like the master password used to encrypt the password you store in a Secret Manager/ Password Storage service. If you get it, you have access to any secret related to that master password, and then you can use them to gain access to apps.

Are we adopting clickbait also in this area? If so, let me introduce the Bronze SAML attack technique:

Bronze SAML attack consists of, through social engineering, making the service provider's system administrator believe that you are the system administrator of the IdP and that you are going to rotate the key/cert of the Identity Provider in a couple of days, and you send an attached public cert that should be registered. If you manage to deceive the app's administrator and the public key starts to be trusted by the app, you will now be able to enter the app by generating SAML messages and signing them with the related private key you possess, impersonating anyone on the app related to that IdP.

#bronze #saml #cybersecurity

Jun 11 · linkedin

Workato is #hiring! We're looking for a new teammate based in India to join our team.

At Workato, ensuring our services are always available, reducing the number of incidents, and providing top-notch support to our customers is crucial. It's no surprise that Workato has earned numerous awards for our dedication to excellence:

  • APPEALIE SaaS Awards https://lnkd.in/d4mn-vH3
  • Workato Leads G2 IPAAS Ranking https://lnkd.in/dYqQd8b5
  • Gartner Magic Quadrant Leader https://lnkd.in/dK_JAdv7

The role of Customer Centric Engineer is a key position in our company. If you are proficient in Ruby & Rails, have experience integrating APIs, excel at troubleshooting, have empathy, and can handle pressure, this position could be yours!

  • Bangalore. https://lnkd.in/dVJgKSDm
  • Hyderabad. https://lnkd.in/dDPuZjag

P.S. This role requires working American hours (9:00 am - 6:00 pm PDT)

Looking forward to your application!

Related Questions

What are Sixto Pablo Martín García's main responsibilities as a Technical Program Manager at Workato?
How long has Sixto Pablo Martín García been with Workato?
What projects has Sixto Pablo Martín García led at Workato?
What skills does Sixto Pablo Martín García bring to his role at Workato?
Can you provide examples of Sixto Pablo Martín García's achievements at Workato?
Sixto Pablo Martín García
Sixto Pablo Martín García, photo 1
Sixto Pablo Martín García, photo 2
Add to my network

Location

Seville, Andalusia, Spain