domains / families / security / identity-federation

identity-federation

authentic

Authorized assessment of federated identity systems: SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token-confusion issues.

When to use

• Testing SSO/federation flows within an approved scope.
• Hunting signature-validation or audience-confusion flaws.

When not to use

• IdP-side testing is often out of scope; confirm boundaries first.
• Token replay tests can lock out real users; stage carefully.

Skill page

Source