saml-sso-assertion-attacks

A security-testing playbook for assessing SAML-based single sign-on and assertion trust. It is intended for authorized testing of enterprise SSO flows, focusing on whether an identity provider's assertions are correctly validated by the service provider. Load it when a target uses SAML requests or responses, when you see SAMLRequest, SAMLResponse, XML assertions, or ACS endpoints, and when login involves an external IdP with browser POST or redirect bindings.

The skill organizes high-value checks into themes: signature validation (unsigned assertions accepted, wrong node signed, signature wrapping), audience and recipient validation (weak Audience, Recipient, Destination, or ACS checks), issuer trust (wrong IdP accepted or multi-tenant issuer confusion), replay and freshness (missing InResponseTo, weak NotBefore/NotOnOrAfter enforcement), account mapping (email-only binding, case folding, unverified attributes), and XML parser behavior such as XXE-like issues or unsafe transforms.

A quick triage procedure guides the tester to capture one full login round trip, inspect which XML nodes are signed and which attributes drive account binding, compare SP-initiated and IdP-initiated flows, and test replay, altered attributes, and assertion placement confusion. It also cross-references related routes for deeper work, pointing to an XXE skill for XML parser depth, an OAuth/OIDC misconfiguration skill for alternative SSO protocols, and an authentication-bypass skill for auth boundary issues that surface after SSO.