<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: auditing-cloud-identity-federation
description: >-
  Audit and secure identity federation configurations across cloud providers.
  Covers SAML, OIDC, and WS-Federation trust relationships, misconfiguration
  detection, token validation, and cross-tenant access policy review for
  AWS, Azure AD, and GCP.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - federation
  - saml
  - oidc
  - azure-ad
  - aws-iam
  - gcp-iam
  - cross-tenant
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1606.002"]
---

# Auditing Cloud Identity Federation

## Overview

Identity federation allows organizations to trust external identity providers
(IdPs) for authentication, enabling SSO across cloud boundaries. Misconfigurations
in federation trust — overly permissive audience restrictions, missing signature
validation, stale trust relationships — create paths for privilege escalation and
unauthorized cross-tenant access. This skill covers auditing federation setups
across AWS, Azure, and GCP.

## Prerequisites

| Requirement | Install |
|---|---|
| AWS CLI v2 | `brew install awscli` |
| Azure CLI | `brew install azure-cli` |
| gcloud CLI | Google Cloud SDK |
| Python 3.10+ | For agent tooling |
| python-jose | `pip install python-jose[cryptography]` |

## Key Concepts

### Federation Trust Models

| Model | Protocol | Use Case |
|---|---|---|
| SAML 2.0 | XML/HTTP POST | Enterprise SSO to SaaS apps |
| OIDC | JWT/OAuth 2.0 | Modern web/mobile app SSO |
| WS-Federation | XML/SOAP | Legacy Microsoft workloads |
| AWS STS AssumeRoleWithSAML | SAML | Federated access to AWS |
| Azure AD External Identities | OIDC/SAML | B2B cross-tenant access |
| GCP Workload Identity Federation | OIDC/SAML | External workload auth to GCP |

### Common Misconfigurations

| Misconfiguration | Risk | Detection |
|---|---|---|
| Wildcard audience restriction | Any app can use the token | Check `aud` claim validation |
| Missing signature validation | Token forgery possible | Review IdP certificate pinning |
| Stale federation trust | Decommissioned IdP still trusted | Audit trust creation dates |
| Over-scoped role mapping | All federated users get admin | Review role condition policies |
| No MFA requirement in federation | Weak auth from partner IdP | Check conditional access policies |
| Token lifetime too long | Extended exposure window | Verify token expiry settings |

### AWS Federation Audit

```bash
# List SAML providers
aws iam list-saml-providers

# Get SAML provider metadata
aws iam get-saml-provider --saml-provider-arn arn:aws:iam::123456789012:saml-provider/ADFS

# List roles assumable via SAML
aws iam list-roles --query "Roles[?AssumeRolePolicyDocument.Statement[?Condition.StringEquals.'SAML:aud']]"

# Check OIDC providers
aws iam list-open-id-connect-providers

# Get OIDC provider details (audience, thumbprint)
aws iam get-open-id-connect-provider --open-id-connect-provider-arn <arn>
```

### Azure AD Federation Audit

```bash
# List federated domains
az rest --method GET --url "https://graph.microsoft.com/v1.0/domains" \
  --query "value[?authenticationType=='Federated']"

# Check cross-tenant access policies
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners"

# List enterprise applications with SAML SSO
az ad sp list --filter "preferredSingleSignOnMode eq 'saml'" --query "[].{name:displayName,appId:appId}"

# Check token signing certificates
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/servicePrincipals/{id}/tokenSigningCertificates"
```

### GCP Workload Identity Federation Audit

```bash
# List workload identity pools
gcloud iam workload-identity-pools list --location=global

# List providers in a pool
gcloud iam workload-identity-pools providers list \
  --workload-identity-pool=<pool-id> --location=global

# Check attribute mappings
gcloud iam workload-identity-pools providers describe <provider-id> \
  --workload-identity-pool=<pool-id> --location=global \
  --format="yaml(attributeMapping,attributeCondition)"
```

### SAML Token Validation Checklist

| Check | Expected | Risk if Missing |
|---|---|---|
| Signature present | Assertion is signed | Token tampering |
| Signature algorithm | RSA-SHA256 or better | Downgrade attacks |
| Audience restriction | Matches service provider entity ID | Token reuse across apps |
| NotBefore / NotOnOrAfter | Valid time window | Replay attacks |
| InResponseTo | Matches AuthnRequest ID | CSRF on SAML flow |
| Recipient URL | Matches ACS endpoint | Token redirect |

## Workflow

1. **Inventory** — Enumerate all federation trusts across AWS, Azure, GCP
2. **Validate configuration** — Check audience, signature, lifetime settings
3. **Review role mappings** — Ensure least-privilege for federated identities
4. **Check certificate hygiene** — Verify signing cert expiry and rotation
5. **Audit access logs** — Review federated authentication events for anomalies
6. **Test token validation** — Attempt token replay and audience substitution
7. **Remediate** — Tighten audience restrictions, enforce MFA, remove stale trusts
8. **Document** — Produce federation trust inventory with risk ratings

## Detection

```yaml
title: Auditing Cloud Identity Federation Detection
id: c837e65c-12e5-4fdd-ad8c-80e622a3c762
status: experimental
description: Detects suspicious activity related to auditing cloud identity federation techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1606.002
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

| Check | Method |
|---|---|
| All federation trusts inventoried | Compare script output against known trust list |
| No wildcard audiences | `aud` claim restricted to specific service provider URIs |
| Signing certificates not expiring | Cert expiry > 90 days for all federation trusts |
| Stale trusts removed | No federation trusts older than policy threshold without review |
| MFA enforced | Conditional access requires MFA for federated users |

## References

- [MITRE ATT&CK T1606.002 — Forge Web Credentials: SAML Tokens](https://attack.mitre.org/techniques/T1606/002/)
- [AWS IAM Identity Federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers.html)
- [Azure AD External Identities](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/)
- [GCP Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation)
