saml-sso-assertion-attacks

SAML SSO assertion validation is tested by capturing a login exchange and verifying whether unsigned or misbound assertions are accepted by checking XML node signature coverage and ACS endpoint enforcement. This detects trust boundary failures in identity provider flows.

Assertion wrapping in SAML authentication is an attack where malicious unsigned assertions are injected alongside signed ones. It bypasses signature checks when a service provider validates the signature but processes the unsigned assertion, granting unauthorized SSO access.

Validating audience and recipient restrictions in a SAMLResponse involves examining the SSO login flow to ensure the service provider strictly enforces intended audience URI and recipient ACS endpoint values. Broad trust mappings indicate vulnerable SSO configuration.

You can check replay resistance and freshness constraints by analyzing SAMLResponse tokens during SP-initiated versus IdP-initiated SSO logins. This verifies whether time validity windows and one-time use conditions are properly enforced by the ACS endpoint.

This approach detects issuer confusion and account mapping vulnerabilities in enterprise SSO by analyzing SAMLResponse attributes and issuer values. It confirms whether service providers correctly map identity provider assertions to local accounts without broad trust.