auditing-saml-and-oidc-federation-trust

name	auditing-saml-and-oidc-federation-trust
description	Audit federated single sign-on for assertions a relying party should not trust: a SAML response whose signature is not verified over the right element so a wrapped or altered assertion passes, an OIDC ID token whose issuer, audience, or nonce is unchecked, a relying party that accepts an assertion for any user because the subject or email is trusted without binding, and a federation that honors an identity provider or signing key it should not. Covers SAML and OpenID Connect where a relying party consumes assertions or ID tokens minted by an identity provider to authenticate users. Use when login trust crosses from an identity provider to a relying party and assertion validation is the boundary. The forged or misbound assertion is the source, the authenticated session it grants is the sink, and the missing signature, issuer, audience, or binding check that accepts it is the bug.
license	MIT

Auditing SAML and OIDC federation trust: the assertion is only as good as its verification

Federated login moves the authentication decision to an identity provider and hands the relying party a signed assertion, a SAML response or an OIDC ID token, that says who the user is. The relying party's entire security then rests on verifying that assertion correctly, and the ways to verify it incorrectly are well worn. SAML signature wrapping slips an unsigned, attacker-authored assertion alongside a signed one so the application reads the wrong element; a signature checked over the wrong scope, or not at all, accepts a tampered response. An OIDC ID token whose issuer, audience, or nonce goes unchecked can come from the wrong provider, be minted for a different application, or be replayed. And a relying party that trusts a subject or email in the assertion without binding it to the verified issuer will authenticate any user an attacker names. The audit is not whether federation is configured but whether a forged or misbound assertion is refused. You audit this by testing each validation the relying party must perform on the assertion.