identity-federation

Original：🇨🇳 Chinese

Translated

Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.

3installs

Sourcezhaoxuya520/reverse-skill

Added on2026-08-13

NPX Install

npx skill4agent add zhaoxuya520/reverse-skill identity-federation

SKILL.md Content (Chinese)

View Translation Comparison →

Identity Federation (SAML / OIDC / OAuth)

ACTION REQUIRED (Execute Immediately After Reading)

```
NOW
```
: Read precedent-pentest; Include SSO test accounts and IdP/SP scope into the scope
```
NOW
```
: Prohibit brute-force attempts that lock real user accounts
```
NEXT
```
: Packet capture tools and documents (metadata URL)
```
ACT
```
: Protocol flow mapping → Common mismatches → Verification

Applicable Scenarios

SAML Response signature/assertion tampering surfaces (classic defect patterns)
OIDC implicit/authorization code + PKCE missing
redirect_uri / state / nonce issues
IdP and SP metadata, multi-tenant issuer confusion
Complementary to
```
api-security
```
JWT attacks (this skill focuses on federation and SSO flows)

Workflow

text

□ Map clearly: User → SP → IdP → Token → SP
□ Collect: /.well-known/openid-configuration, SAML metadata
□ Check: Exact redirect_uri matching, state binding, PKCE
□ Check: SAML signature coverage, algorithm downgrade
□ Session fixation and logout invalidation

Toolchain

Tool	Purpose
Burp + SAML Raider, etc.	Assertion editing (authorization)
jwt_tool	JWT segments
Browser DevTools	Redirect chain
IdP management logs	Audit

References

```
references/sso-flow-checklist.md
```
```
../api-security/
```
```
../windows-ad/
```
(Enterprise IdP)

Routing Context

Upstream: MASTER R37
Downstream: Pure API JWT → api-security; Cloud IdP → cloud-k8s

Task Completion Self-Check

Is the complete SSO flow mapped?
Does each Finding have reproduction steps and impact description?
Checklist completed?