identity-federation

Identity Federation (SAML / OIDC / OAuth)

ACTION REQUIRED (execute immediately after reading)

1. NOW: Read precedent-pentest; SSO test accounts and IdP/SP scope into scope
2. NOW: Brute-force attempts that lock real user accounts are prohibited
3. NEXT: Packet capture tools and documentation (metadata URLs)
4. ACT: Protocol flow mapping → common misconfigurations → verification

Applicable Scenarios

• SAML Response signature/assertion tampering surface (classic flaw pattern)
• OIDC implicit/authorization code + missing PKCE
• redirect_uri / state / nonce issues
• IdP and SP metadata, multi-tenant issuer confusion
• Complementary to api-security JWT attacks (this skill focuses on federation and SSO flows)

Workflow

□ 画清：User → SP → IdP → Token → SP
□ 收集：/.well-known/openid-configuration、SAML metadata
□ 检查：redirect_uri 精确匹配、state 绑定、PKCE
□ 检查：SAML 签名覆盖范围、algorithm 降级
□ 会话固定与登出失效

Toolchain

Tool	Purpose
Burp + SAML Raider etc.	Assertion editing (authorized)
jwt_tool	JWT segment
Browser DevTools	Redirect chain
IdP admin logs	Audit

References

• references/sso-flow-checklist.md
• ../api-security/ ../windows-ad/(enterprise IdP)

Routing Context

Upstream: MASTER R37
Downstream: Pure API JWT → api-security; cloud IdP → cloud-k8s

Task Completion Self-Check

• Is the full SSO flow mapped?
• Does each Finding have reproduction and impact?
• Checklist？