Name: identity-federation
Author: zhaoxuya520

Imported from zhaoxuya520/reverse-skill (skills/identity-federation/SKILL.md) via skills.sh. Install upstream with npx skills add zhaoxuya520/reverse-skill --skill identity-federation. Copyright stays with the author.

Identity Federation (SAML / OIDC / OAuth)

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 precedent-pentest；SSO 测试账号与 IdP/SP 范围入 scope
NOW: 禁止锁定真实用户账户的暴力尝试
NEXT: 抓包工具与文档（元数据 URL）
ACT: 协议流映射 → 常见错配 → 验证

适用场景

SAML Response 签名/断言篡改面（经典缺陷模式）
OIDC 隐式/授权码 + PKCE 缺失
redirect_uri / state / nonce 问题
IdP 与 SP 元数据、多租户 issuer 混淆
与 api-security JWT 攻击互补（本 skill 偏联邦与 SSO 流）

工作流

□ 画清：User → SP → IdP → Token → SP
□ 收集：/.well-known/openid-configuration、SAML metadata
□ 检查：redirect_uri 精确匹配、state 绑定、PKCE
□ 检查：SAML 签名覆盖范围、algorithm 降级
□ 会话固定与登出失效

工具链

工具	用途
Burp + SAML Raider 等	断言编辑（授权）
jwt_tool	JWT 段
浏览器 DevTools	重定向链
IdP 管理日志	审计

参考

references/sso-flow-checklist.md
../api-security/ ../windows-ad/（企业 IdP）

路由上下文

上游: MASTER R37
下游: 纯 API JWT → api-security；云 IdP → cloud-k8s

任务完成自检

是否映射完整 SSO 流？
每个 Finding 是否有复现与影响？
Checklist？

Install identity-federation and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "zhaoxuya520-reverse-skill-identity-federation", "kind": "skill", "name": "identity-federation", "description": "Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.", "publisher": "zhaoxuya520", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/zhaoxuya520/reverse-skill", "path": "skills/identity-federation/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/zhaoxuya520/reverse-skill/identity-federation", "key": "zhaoxuya520/reverse-skill/skills/identity-federation/SKILL.md" } }, "instructions": "# Identity Federation (SAML / OIDC / OAuth)\n\n## ACTION REQUIRED（读完后立刻执行）\n\n1. `NOW`: 读取 precedent-pentest；SSO 测试账号与 IdP/SP 范围入 scope\n2. `NOW`: 禁止锁定真实用户账户的暴力尝试\n3. `NEXT`: 抓包工具与文档（元数据 URL）\n4. `ACT`: 协议流映射 → 常见错配 → 验证\n\n## 适用场景\n\n- SAML Response 签名/断言篡改面（经典缺陷模式）\n- OIDC 隐式/授权码 + PKCE 缺失\n- redirect_uri / state / nonce 问题\n- IdP 与 SP 元数据、多租户 issuer 混淆\n- 与 `api-security` JWT 攻击互补（本 skill 偏联邦与 SSO 流）\n\n## 工作流\n\n```text\n□ 画清：User → SP → IdP → Token → SP\n□ 收集：/.well-known/openid-configuration、SAML metadata\n□ 检查：redirect_uri 精确匹配、state 绑定、PKCE\n□ 检查：SAML 签名覆盖范围、algorithm 降级\n□ 会话固定与登出失效\n```\n\n## 工具链\n\n| 工具 | 用途 |\n", "cost": { "context_tokens": 241 } }

identity-federation

About