identity-federation

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Identity Federation (SAML / OIDC / OAuth)

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute Immediately After Reading)

```
NOW
```
: 读取 precedent-pentest；SSO 测试账号与 IdP/SP 范围入 scope
```
NOW
```
: 禁止锁定真实用户账户的暴力尝试
```
NEXT
```
: 抓包工具与文档（元数据 URL）
```
ACT
```
: 协议流映射 → 常见错配 → 验证

```
NOW
```
: Read precedent-pentest; Include SSO test accounts and IdP/SP scope into the scope
```
NOW
```
: Prohibit brute-force attempts that lock real user accounts
```
NEXT
```
: Packet capture tools and documents (metadata URL)
```
ACT
```
: Protocol flow mapping → Common mismatches → Verification

适用场景

Applicable Scenarios

SAML Response 签名/断言篡改面（经典缺陷模式）
OIDC 隐式/授权码 + PKCE 缺失
redirect_uri / state / nonce 问题
IdP 与 SP 元数据、多租户 issuer 混淆
与
```
api-security
```
JWT 攻击互补（本 skill 偏联邦与 SSO 流）

SAML Response signature/assertion tampering surfaces (classic defect patterns)
OIDC implicit/authorization code + PKCE missing
redirect_uri / state / nonce issues
IdP and SP metadata, multi-tenant issuer confusion
Complementary to
```
api-security
```
JWT attacks (this skill focuses on federation and SSO flows)

工作流

Workflow

text

□ 画清：User → SP → IdP → Token → SP
□ 收集：/.well-known/openid-configuration、SAML metadata
□ 检查：redirect_uri 精确匹配、state 绑定、PKCE
□ 检查：SAML 签名覆盖范围、algorithm 降级
□ 会话固定与登出失效

text

□ Map clearly: User → SP → IdP → Token → SP
□ Collect: /.well-known/openid-configuration, SAML metadata
□ Check: Exact redirect_uri matching, state binding, PKCE
□ Check: SAML signature coverage, algorithm downgrade
□ Session fixation and logout invalidation

工具链

Toolchain

工具	用途
Burp + SAML Raider 等	断言编辑（授权）
jwt_tool	JWT 段
浏览器 DevTools	重定向链
IdP 管理日志	审计

Tool	Purpose
Burp + SAML Raider, etc.	Assertion editing (authorization)
jwt_tool	JWT segments
Browser DevTools	Redirect chain
IdP management logs	Audit

参考

References

```
references/sso-flow-checklist.md
```
```
../api-security/
```
```
../windows-ad/
```
（企业 IdP）

```
references/sso-flow-checklist.md
```
```
../api-security/
```
```
../windows-ad/
```
(Enterprise IdP)

路由上下文

Routing Context

上游: MASTER R37
下游: 纯 API JWT → api-security；云 IdP → cloud-k8s

Upstream: MASTER R37
Downstream: Pure API JWT → api-security; Cloud IdP → cloud-k8s

任务完成自检

Task Completion Self-Check

是否映射完整 SSO 流？
每个 Finding 是否有复现与影响？
Checklist？

Is the complete SSO flow mapped?
Does each Finding have reproduction steps and impact description?
Checklist completed?