<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: designing-secure-authentication-architecture
description: >-
  Design secure authentication architectures with phishing-resistant MFA, passwordless
  flows, SSO federation, service identity management, and session handling across
  web, mobile, and API authentication patterns.
domain: cybersecurity
subdomain: security-architecture
tags:
  - authentication
  - mfa
  - fido2
  - webauthn
  - sso
  - oauth2
  - oidc
  - passwordless
  - session-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Designing Secure Authentication Architecture

## Overview

Authentication architecture is the first line of identity-based defense. This skill
covers designing authentication systems with phishing-resistant MFA (FIDO2/WebAuthn),
SSO federation (SAML/OIDC), service identity patterns, session management, and
credential lifecycle management.

Mode: `[MODE: ARCHITECT]` — Authentication security design.

## Prerequisites

| Requirement | Details |
|---|---|
| Identity provider (Entra ID, Okta, Auth0, or equivalent) | Required |
| FIDO2 security key or platform authenticator support | Required |
| Python 3.10+ | Required |

## Key Concepts

### Authentication Architecture Layers

```
┌────────────────────────────────────────────────────────┐
│                 AUTHENTICATION STACK                    │
├──────────────────┬─────────────────────────────────────┤
│  User Auth       │  Service Auth                       │
├──────────────────┼─────────────────────────────────────┤
│  FIDO2/WebAuthn  │  mTLS (certificate-based)           │
│  OIDC/SAML SSO   │  Workload Identity (cloud-native)   │
│  TOTP/Push MFA   │  Service Account + Secret rotation  │
│  Password + MFA  │  SPIFFE/SPIRE (mesh identity)       │
├──────────────────┴─────────────────────────────────────┤
│            Session Management Layer                     │
│  Secure tokens, rotation, revocation, idle timeout     │
├────────────────────────────────────────────────────────┤
│            Credential Lifecycle                         │
│  Provisioning → Rotation → Revocation → Audit          │
└────────────────────────────────────────────────────────┘
```

### FIDO2/WebAuthn Registration Flow

```python
from webauthn import generate_registration_options, verify_registration_response
from webauthn.helpers.structs import (
    AuthenticatorSelectionCriteria,
    ResidentKeyRequirement,
    UserVerificationRequirement,
)

def register_fido2(user_id: str, username: str, rp_id: str) -> dict:
    """Generate FIDO2 registration challenge."""
    options = generate_registration_options(
        rp_id=rp_id,
        rp_name="Secure App",
        user_id=user_id.encode(),
        user_name=username,
        authenticator_selection=AuthenticatorSelectionCriteria(
            resident_key=ResidentKeyRequirement.REQUIRED,
            user_verification=UserVerificationRequirement.REQUIRED,
        ),
        exclude_credentials=[],  # Existing credentials to prevent re-registration
    )
    return {
        "challenge": options.challenge,
        "rp": {"id": rp_id, "name": "Secure App"},
        "user": {"id": user_id, "name": username},
    }
```

### SSO Federation Architecture

```
    User              IdP (Okta/Entra)        Service Provider
     │                     │                        │
     ├─── Login ──────────►│                        │
     │                     ├── Authenticate ────►   │
     │                     │   (MFA challenge)      │
     │    ◄── MFA ─────────┤                        │
     ├─── MFA Response ───►│                        │
     │                     ├── Issue Token ─────►   │
     │                     │   (SAML/OIDC)          │
     │    ◄── Redirect ────┤                        │
     ├─── Token ───────────┼───────────────────────►│
     │                     │                        ├── Validate Token
     │    ◄── Session ─────┼────────────────────────┤
```

### Session Security Configuration

```python
SESSION_CONFIG = {
    "cookie": {
        "name": "__Host-session",    # Host-prefix prevents domain scoping attacks
        "httponly": True,             # No JavaScript access
        "secure": True,              # HTTPS only
        "samesite": "Lax",           # CSRF protection
        "max_age": 3600,             # 1 hour maximum
        "path": "/",
    },
    "idle_timeout_minutes": 15,       # Idle session timeout
    "absolute_timeout_minutes": 480,  # Max session lifetime (8 hours)
    "rotation_interval_minutes": 15,  # Rotate session ID every 15 min
    "concurrent_sessions": 3,         # Max concurrent sessions per user
    "bind_to_ip": False,              # Breaks mobile users
    "bind_to_user_agent": True,       # Detect session hijacking
}
```

### Service Identity Patterns

```bash
# AWS — IAM Role for service (no long-lived keys)
aws iam create-role --role-name app-service-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "ecs-tasks.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'

# Kubernetes — Workload Identity (GKE)
gcloud iam service-accounts create app-sa --project=$PROJECT
gcloud iam service-accounts add-iam-policy-binding app-sa@$PROJECT.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:$PROJECT.svc.id.goog[namespace/ksa-name]"

# SPIFFE identity verification
# Each workload gets: spiffe://trust-domain/workload-path
```

## Workflow

### Step 1: Assess Current Authentication

```bash
node scripts/agent.js --action assess
```

### Step 2: Design Authentication Architecture

```bash
node scripts/agent.js --action design --mfa fido2 --sso oidc
```

### Step 3: Generate Configuration

```bash
node scripts/agent.js --action configure --provider okta --output auth-config.json
```

### Step 4: Validate Implementation

```bash
node scripts/agent.js --action validate --config auth-config.json
```

## Detection

```yaml
title: Designing Secure Authentication Architecture Detection
id: 043f43db-8c11-4e1b-b550-8fd1f5ce0bfc
status: experimental
description: Detects suspicious activity related to designing secure authentication architecture techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Designing Secure Authentication Architecture Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078 |

## Verification

- [ ] Phishing-resistant MFA (FIDO2) enforced for privileged accounts
- [ ] SSO configured with OIDC/SAML for all applications
- [ ] Password policy meets NIST SP 800-63B guidelines
- [ ] Session cookies use __Host- prefix, HttpOnly, Secure, SameSite
- [ ] Session idle timeout ≤ 15 minutes for sensitive applications
- [ ] Service accounts use workload identity (no long-lived credentials)
- [ ] Credential rotation automated for all service accounts
- [ ] Failed authentication attempts logged and monitored

## References

- [NIST SP 800-63B — Authentication and Lifecycle Management](https://pages.nist.gov/800-63-3/sp800-63b.html)
- [FIDO2/WebAuthn Specification](https://www.w3.org/TR/webauthn-3/)
- [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)
