What you’ll be able to do
- Name the five failure concepts and one owner habit for each.
- Keep the habits at the level of scope, audience, lifetime, and evidence type.
- Pick two cards and name the first log type you would open, without a hunt procedure.
- State that federation trust does not move every identity risk onto the IdP vendor.
Concepts and habits, not recipes
Harbor Mail trusts Riverstone IdP. The tickets and assertions from IF1 and IF2 can still be stolen, presented to the wrong API, or replayed. This lesson names five failure concepts and the habit an owner keeps. It does not give exploit steps, payloads, or bypass recipes.
RFC 9700, BCP 240, January 2025, is the security anchor for the OAuth cards. SAML Conditions and the OIDC nonce cover the assertion card. IdP compromise is conceptual: tie it to F4 recovery and F7 evidence. Do not invent a CVE for Riverstone IdP.
Five cards
Token theft: a bearer token works for whoever holds it. Leakage shows up in redirects, logs, referrers, or a compromised resource server. Prefer short-lived access tokens, restrict audience and scope, consider sender-constraining where the stack offers it, and never put access tokens in a URI query. RFC 9700 sections 2.2, 2.3, 4.1 through 4.3, and 4.9 are the anchors. TLS on the API does not make a long-lived bearer token fine.
Confused deputy: a client or service uses delegated power the user did not intend for that action. Keep least-privilege scopes, separate client identities, and do not reuse one broad token across deputies. F5 is the local habit. A consent screen from the SaaS industry module is not this trust model by itself.
Mis-audience: a token or assertion is accepted at the wrong resource server or service provider. Enforce audience or resource restriction. Reject a token that names another API. RFC 9700 section 4.10.2, the OIDC aud check, and SAML AudienceRestriction are the same idea in three places.
IdP or authorization-server compromise: someone who controls the issuer can mint tickets your apps already trust. Watch IdP admin paths, keep a break-glass account that is not the everyday federated login, and write down the blast radius of that trust. An incident play revokes sessions and the federation trust. F4 recovery and F7 evidence are the local hooks. The vendor does not absorb that risk for you.
Assertion or code replay: a one-time code or assertion is reused outside its window. Treat authorization codes as one-time, validate time conditions, and treat nonce and PKCE as ideas that bind a code to the client that started the request. RFC 9700 discusses PKCE and injection. SAML Conditions and the OIDC nonce are the matching limits. This card stops at the idea.
| Card | Concept | Owner habit |
|---|---|---|
| Token theft | Whoever holds a bearer token can use it. | Short lifetime, tight audience and scope, no token in a query string. |
| Confused deputy | Delegated power is used for an action the user did not intend. | Least privilege, separate client identities, no shared over-broad token. |
| Mis-audience | A token or assertion is accepted by the wrong API or app. | Enforce audience. Reject tickets minted for somewhere else. |
| IdP compromise | The issuer can mint tickets every app already trusts. | Watch admin paths, keep break-glass, plan to revoke sessions and trust. |
| Replay | A one-time code or assertion is used again outside its window. | One-time codes, time conditions, nonce and PKCE as ideas. |
Two cards, two evidence types
The exit ticket is a pair of log types, not a hunt. For token theft, open the token-issuance log and the redirect log: who received a token, and whether a redirect carried it. For mis-audience, open the resource server’s reject log: the audience it refused. For IdP compromise, open the IdP admin audit log. For replay, open the assertion or code redemption log and look for a second use of the same one-time value.
At work, open one SaaS admin list of OAuth apps or enterprise apps and name one over-scoped grant to review. Keep that review private. Do not paste secrets or live tokens into Atlas. Federation moved the password to Riverstone IdP. Harbor Mail still owns audience checks, local authorization, and the logs that show a ticket was misused.
CHECK YOUR JUDGMENT