Test SSO and Identity Federation Security Vulnerabilities

This skill tests SAML, OIDC, and OAuth identity federation and SSO flows for classic flaw patterns: SAML response signature or assertion tampering, OIDC implicit or authorization-code flows missing PKCE, redirect_uri/state/nonce handling issues, and IdP/SP metadata or multi-tenant issuer confusion. It complements the api-security skill's JWT-specific attacks by focusing on the federation and SSO flow itself rather than a bare API token.

Use it to test SSO or federation flows within an approved scope, or to hunt for signature-validation or audience-confusion flaws. IdP-side testing is often out of scope by default, so confirm boundaries before touching the identity provider itself; token-replay tests can lock out real users, so stage them carefully rather than running them against live production accounts.

Input is the SSO/federation flow to be mapped, from user through the service provider to the identity provider and back with a token, plus the /.well-known/openid-configuration document and SAML metadata for the target. The mapping step comes first, deliberately, because most of the findings below only make sense once the actual token path is drawn out. Output is a set of findings on redirect_uri exact-match enforcement, state and PKCE binding, SAML signature coverage and algorithm-downgrade risk, and session fixation or logout invalidation, each documented with reproduction steps and impact.

Burp Suite with SAML Raider (or an equivalent extension) edits SAML assertions under authorization; jwt_tool inspects JWT segments; browser DevTools trace the redirect chain; IdP admin logs support auditing confirmed findings.

Security testers assessing SSO or federation implementations (SAML, OIDC, OAuth) within an approved engagement, distinct from testers focused purely on API-level JWT attacks or on enterprise Active Directory-based identity providers, though the two areas often overlap in a real engagement.