SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsidentity-federation

identity-federation

Security & auditing

View repository

Updated 10-22 03:16

About this skill

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

  1. Ask the user to state the exact target URL, IP, account, or resource.
  2. Ask the user to confirm written authorization and the permitted scope.
  3. Show the exact command(s) and explain their expected effect.
  4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Identity Federation (SAML / OIDC / OAuth)

When to Use

  • Testing SSO/federation flows within an approved scope.
  • Hunting signature-validation or audience-confusion flaws.

Applicable scenarios

  • SAML Response signature/assertion tampering surface (classic defect pattern)
  • OIDC implicit/authorization code + missing PKCE
  • redirect_uri / state / nonce issues
  • IdP and SP metadata, multi-tenant issuer confusion
  • Complementary to api-security JWT attacks (this skill focuses on federation and SSO flows)

Workflow

□ 画清：User → SP → IdP → Token → SP
□ 收集：/.well-known/openid-configuration、SAML metadata
□ 检查：redirect_uri 精确匹配、state 绑定、PKCE
□ 检查：SAML 签名覆盖范围、algorithm 降级
□ 会话固定与登出失效

Toolchain

Tool Purpose
Burp + SAML Raider etc. Assertion editing (authorized)
jwt_tool JWT segments
Browser DevTools Redirect chain
IdP admin logs Audit

References

  • references/sso-flow-checklist.md
  • ../api-security/ ../windows-ad/(enterprise IdP)

Routing context

Upstream: MASTER R37
Downstream: pure API JWT → api-security; cloud IdP → cloud-k8s

Task completion self-check

  • Is the complete SSO flow mapped?
  • Does every Finding have reproduction and impact?
  • Checklist？

Limitations

  • IdP-side testing is often out of scope; confirm boundaries first.
  • Token replay tests can lock out real users; stage carefully.

Adapted from zhaoxuya520/reverse-skill (MIT).