<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-federation-trust-relationships
description: >-
  Audit SAML, OIDC, and WS-Federation trust configurations between identity
  providers and service providers. Covers Azure AD external identities,
  AD FS relying party trusts, Okta federation brokers, certificate validation,
  and detection of rogue federation trusts used in identity attacks.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - federation
  - saml
  - adfs
  - azure-ad
  - okta
  - trust-relationships
  - identity-provider
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1606.002"]
---

# Auditing Federation Trust Relationships

## Overview

Federation trusts allow identity assertions to cross organizational boundaries.
A compromised or misconfigured federation trust is a critical attack vector —
attackers who control a trusted IdP can forge assertions to access any relying
party. The SolarWinds attack (Golden SAML) demonstrated that compromising
AD FS token signing certificates grants persistent, undetectable access across
all federated services.

Mode: `[MODE: BLUE]` for trust audit; `[MODE: RED]` for federation abuse testing.

MITRE ATT&CK: T1484.002 (Trust Modification), T1606.002 (SAML Tokens)

## Prerequisites

- Azure AD Global Reader or Security Reader role
- AD FS admin access (for on-premises federation)
- Okta Super Administrator (for Okta federation review)
- PowerShell with Microsoft.Graph and ADFS modules
- Python 3.10+ for agent tooling

## Key Concepts

### Federation Attack Surface

| Attack | Vector | Severity |
|--------|--------|----------|
| Golden SAML | Stolen token signing certificate | Critical |
| Rogue IdP Trust | Attacker adds trusted identity provider | Critical |
| Certificate Rollover Gap | Expired/weak signing certificates | High |
| Audience Restriction Bypass | SAML assertion accepted by wrong SP | High |
| Claims Manipulation | Injected roles/groups via custom claims | High |
| Subdomain Takeover | Dangling federation DNS records | Medium |

### Azure AD Federation Audit

```powershell
# List all federated domains
Connect-MgGraph -Scopes "Domain.Read.All"
Get-MgDomain | Where-Object { $_.AuthenticationType -eq "Federated" } |
  Select-Object Id, AuthenticationType, IsVerified

# Get federation configuration for each domain
Get-MgDomainFederationConfiguration -DomainId "contoso.com" |
  Select-Object DisplayName, IssuerUri, MetadataExchangeUri,
    PassiveSignInUri, SigningCertificate, PreferredAuthenticationProtocol

# List external identity providers (B2B)
Get-MgIdentityProvider | Select-Object DisplayName, Type, ClientId

# Check cross-tenant access settings
Get-MgPolicyCrossTenantAccessPolicyPartner |
  Select-Object TenantId, IsServiceProvider,
    @{N="InboundTrust"; E={$_.InboundTrust | ConvertTo-Json -Compress}}
```

### AD FS Trust Audit

```powershell
# List all relying party trusts
Get-AdfsRelyingPartyTrust | Select-Object Name, Identifier, Enabled,
  TokenLifetime, EncryptClaims, SignedSamlRequestsRequired,
  @{N="CertExpiry"; E={$_.RequestSigningCertificate.NotAfter}}

# Check token signing certificate
Get-AdfsCertificate -CertificateType Token-Signing |
  Select-Object Thumbprint, Certificate, StoreLocation |
  ForEach-Object {
    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]$_.Certificate
    [PSCustomObject]@{
      Thumbprint = $_.Thumbprint
      NotAfter = $cert.NotAfter
      KeySize = $cert.PublicKey.Key.KeySize
      SignatureAlgorithm = $cert.SignatureAlgorithm.FriendlyName
    }
  }

# List claims issuance rules for each RP trust
Get-AdfsRelyingPartyTrust | ForEach-Object {
  [PSCustomObject]@{
    Name = $_.Name
    IssuanceTransformRules = $_.IssuanceTransformRules
    IssuanceAuthorizationRules = $_.IssuanceAuthorizationRules
  }
}

# Check for rogue trusts added recently
Get-AdfsRelyingPartyTrust | Where-Object {
  $_.LastUpdateTime -gt (Get-Date).AddDays(-30)
} | Select-Object Name, Identifier, LastUpdateTime
```

### Okta Federation Audit

```bash
# List identity providers in Okta
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/idps" | \
  jq '.[] | {id, type, name, status, protocol: .protocol.type,
    issuer: .protocol.credentials.trust.issuer}'

# Review IdP certificate details
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/idps/IDP_ID/credentials/keys" | \
  jq '.[] | {kid, x5c: .x5c[0][:40], use, created, expiresAt}'
```

## Workflow

1. **Inventory** — Enumerate all federation trusts across Azure AD, AD FS, Okta
2. **Validate Certificates** — Check expiry, key size (≥ 2048), algorithm (≥ SHA-256)
3. **Review Claims** — Audit issuance rules for role/group injection vectors
4. **Check Audience** — Verify audience restriction on every SAML assertion
5. **Monitor Changes** — Alert on new trust additions or certificate rotations
6. **Test** — Attempt cross-tenant access with manipulated assertions

## Detection

```yaml
title: Auditing Federation Trust Relationships Detection
id: 155f8284-2847-4633-bbd9-2de9f06f5f79
status: experimental
description: Detects suspicious activity related to auditing federation trust relationships techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1606.002
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

- [ ] All federation trusts inventoried and documented with business justification
- [ ] Token signing certificates ≥ 2048-bit RSA or P-256 ECDSA
- [ ] Certificate expiry monitored with 30-day advance alerting
- [ ] Claims issuance rules reviewed — no wildcard role/group mappings
- [ ] Audience restriction configured on all SAML assertions
- [ ] AD FS event logs (EID 510, 511) forwarded to SIEM
- [ ] Azure AD cross-tenant access policies restrict inbound trust
- [ ] Stale/unused federation trusts removed

## References

- [Microsoft — Securing AD FS](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs)
- [CrowdStrike — Golden SAML Technical Analysis](https://www.crowdstrike.com/blog/golden-saml-identity-attack/)
- [Okta Identity Provider Documentation](https://developer.okta.com/docs/concepts/identity-providers/)
- [MITRE ATT&CK T1484.002](https://attack.mitre.org/techniques/T1484/002/)
- [MITRE ATT&CK T1606.002](https://attack.mitre.org/techniques/T1606/002/)
