8.1 Federation Threats
All changes in this version
Title changed
Before · SP 800-63C
Federation Threats
After · SP 800-63C-4
Federation Threats
Control changed
Before · SP 800-63C
As in non-federated authentication, attackers’ motivations are typically to gain access (or a greater level of access) to a resource or service provided by an RP. Attackers may also attempt to impersonate a subscriber. Rogue or compromised IdPs, RPs, user agents (e.g., browsers), and parties outside of a typical federation transaction are potential attackers. To accomplish their attack, they might intercept or modify assertions and assertion references. Further, two or more entities may attempt to subvert federation protocols by directly compromising the integrity or confidentiality of the assertion data. For the purpose of these types of threats, any authorized parties who attempt to exceed their privileges are considered attackers.
In some cases, the subscriber is issued some secret information so they can be recognized by the RP. Knowledge of this information distinguishes the subscriber from attackers who wish to impersonate them. In the case of holder-of-key assertions, this secret could have been established with the IdP prior to the initiation of the federation protocol.
Table 8-1 Federation Threats
Federation Threat/Attack Description Example
Assertion Manufacture or Modification The attacker generates a false assertion Compromised IdP asserts identity of a claimant who has not properly authenticated
The attacker modifies an existing assertion Compromised proxy that changes AAL of an authentication assertion
Assertion Disclosure Assertion visible to third party Network monitoring reveals subscriber address of record to an outside party
Assertion Repudiation by the IdP IdP later claims not to have signed transaction User engages in fraudulent credit card transaction at RP, IdP claims not to have logged them in Federation Threat/Attack Description Example
Assertion Repudiation by the Subscriber Subscriber claims not to have performed transaction User agreement (e.g., contract) cannot be enforced
Assertion Redirect Assertion can be used in unintended context Compromised user agent passes assertion to attacker who uses it elsewhere
Assertion Reuse Assertion can be used more than once with same RP Intercepted assertion used by attacker to authenticate their own session
Assertion Substitution Attacker uses an assertion intended for a different subscriber Session hijacking attack between IdP and RP
After · SP 800-63C-4
As in non-federated authentication, attackers’ motivations are typically to gain access (or a greater level of access) to a resource or service provided by an RP. Attackers may also attempt to impersonate a subscriber. Rogue or compromised IdPs, RPs, user agents (e.g., browsers), and parties outside of a typical federation transaction are potential attackers. To accomplish their attack, they might intercept or modify assertions and assertion references. Further, two or more entities may attempt to subvert federation protocols by directly compromising the integrity or confidentiality of the assertion data. For the purpose of these types of threats, any authorized parties who attempt to exceed their privileges are considered attackers.
In some cases, the subscriber is issued some secret information so they can be recognized by the RP. Knowledge of this information distinguishes the subscriber from attackers who wish to impersonate them. In the case of holder-of-key assertions, this secret could have been established with the IdP prior to the initiation of the federation protocol.
Table 8-1 Federation Threats
Federation Threat/Attack Description Example
Assertion Manufacture or Modification The attacker generates a false assertion Compromised IdP asserts identity of a claimant who has not properly authenticated
The attacker modifies an existing assertion Compromised proxy that changes AAL of an authentication assertion
Assertion Disclosure Assertion visible to third party Network monitoring reveals subscriber address of record to an outside party
Assertion Repudiation by the IdP IdP later claims not to have signed transaction User engages in fraudulent credit card transaction at RP, IdP claims not to have logged them in Federation Threat/Attack Description Example
Assertion Repudiation by the Subscriber Subscriber claims not to have performed transaction User agreement (e.g., contract) cannot be enforced
Assertion Redirect Assertion can be used in unintended context Compromised user agent passes assertion to attacker who uses it elsewhere
Assertion Reuse Assertion can be used more than once with same RP Intercepted assertion used by attacker to authenticate their own session
Assertion Substitution Attacker uses an assertion intended for a different subscriber Session hijacking attack between IdP and RP