auditing-saml-and-oidc-flows

# Auditing SAML and OIDC flows: the whole trust rests on one verification Federated login moves the trust boundary to a signed assertion from an identity provider, and the entire security rests on the relying party verifying that assertion exactly. The classic flaws are all failures of that verification: a signature checked over the wrong element, a token accepted without a signature, an audience or redirect target not pinned, a flow with no anti-replay value. Each lets an attacker present an identity that is not theirs. ## When to use - You are reviewing a SAML or OIDC integration or an identity-provider connection. - A login trusts an externally-issued, signed assertion or token. - You are assessing account-linking and how an external identity maps to a local one. ## Scope check Audit login flows you own or are authorized to test, with test accounts and a test identity provider. Do not forge assertions against systems you do not control. If you can't name the authorization, stop. ## The loop 1. **Identify the trusted assertion and where it is verified.** Find the token or assertion the relying party trusts (a signed SAML assertion, an OIDC id token) and the exact code that validates it. Everything downstream trusts whatever that check accepts, so the check is the audit target. 2. **Test signature presence and coverage.** Is every accepted assertion actually signed, and is the signature verified over the exact element whose contents are used? Try strip...