メニュー
Establish SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD) for seamless cross-domain authentication and SSO.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/OWASP/openshield --skill building-identity-federation-with-saml-azure-adコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.
Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.
Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.
| name | building-identity-federation-with-saml-azure-ad |
| description | Establish SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD) for seamless cross-domain authentication and SSO. |
| domain | cybersecurity |
| subdomain | identity-access-management |
| tags | ["saml","azure-ad","entra-id","federation","hybrid-identity","sso"] |
| version | 1.0 |
| author | openshield |
| license | Apache-2.0 |
| nist_csf | ["PR.AC-1","PR.AC-4","PR.AC-7","DE.CM-3","PR.AA-1","PR.AA-2"] |
| Term | Definition |
|---|---|
| IdP | Identity Provider (e.g., AD FS, Okta, Microsoft Entra ID) |
| SAML 2.0 | XML-based standard for exchanging authentication and authorization data |
| Token-Signing | Use of X.509 certificates to sign SAML assertions to ensure authenticity |
| Relying Party | The application or service that trusts the IdP for authentication |
| Rule | Description | Severity |
|---|---|---|
| AZ-IDN-009 | Missing Alerts for Role Assignment Changes | MEDIUM |
| AZ-IDN-002 | No MFA Enforced on Admin Accounts via Conditional Access | HIGH |
| AZ-IDN-004 | No Privileged Identity Management for Admin Roles | HIGH |
Ensure the token-signing certificate is valid and not nearing expiry.
# Using MS Graph to set federation
New-MgDomainFederationConfiguration -DomainId "corp.example.com" -BodyParameter $federationConfig
Map AD attributes (UPN, Email) to SAML assertions expected by Entra ID.