Skill UI

A comprehensive playbook for testing security flaws in OAuth 2.0 and OpenID Connect (OIDC) implementations. Use this guide to systematically check for misconfigurations in redirect URI handling, state and nonce validation, PKCE enforcement, token audience/issuer checks, and account binding vulnerabilities. Essential for reviewing applications linked to external identity providers.

This guide details how to establish SAML 2.0 identity federation between on-premises Active Directory (using AD FS or third-party IdP) and Microsoft Entra ID. It covers hybrid identity architectures, configuring federation models (AD FS, PHS, PTA), and implementing the full SAML authentication flow. Essential for extending on-premises authentication authority to cloud resources and maintaining security compliance.

A comprehensive guide to configuring and hardening SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end flow implementation, attribute mapping, advanced security controls like SHA-256 signatures and AES-256 encryption, and testing procedures for robust, enterprise-grade identity access management systems.

This skill guides users through hardening LDAP directory services against critical security vulnerabilities, such as LDAP injection, credential harvesting, and anonymous binding bypass. It covers implementing robust security controls including LDAPS enforcement, channel binding, and LDAP signing, essential for maintaining compliance and securing identity infrastructure in regulated environments.

This tool automates the OAuth 2.0 scope minimization review process. It identifies over-permissioned third-party application integrations, excessive API scopes, and risky OAuth consent patterns across identity providers. It is crucial for security audits, compliance (GDPR, SOC 2), and enforcing the least-privilege principle for cross-boundary data access.

This skill covers implementing continuous, risk-adaptive identity verification within a Zero Trust framework. It utilizes phishing-resistant MFA (FIDO2/WebAuthn) and risk-based conditional access policies, ensuring robust and dynamic security controls. Use when designing advanced identity architectures or improving compliance security.

This guide details how to implement Identity-Aware Proxy (IAP) using gcloud. It enforces per-request identity verification and context-aware access policies (e.g., device posture, location) across major GCP backends, including Compute Engine, App Engine, Cloud Run, and GKE. It is essential for migrating from traditional VPN access to a robust, zero-trust, identity-based security architecture for cloud applications.

This comprehensive audit guide assists researchers in preparing papers for CoNEXT submission. It covers critical workflow stages, including choosing the correct submission cycle (December or June), adhering to ACM acmart formatting and strict page budgets, managing the two-step registration process, ensuring double-anonymous review compliance, and implementing essential security checks to prevent identity leaks in artifacts and metadata.

A specialized downstream skill for deep security analysis of JSON Web Tokens (JWT), JWS, and JWE. It guides the identification of vulnerabilities where token components (headers, claims, keying) lead to unauthorized identity assumption or privilege escalation. Use this to trace the full path from token supply to final application acceptance.

This specialized skill is designed to trace and prove the complete flow of OAuth or OIDC authentication, acting as a downstream specialization after an orchestrator has established sandbox assumptions. It meticulously tracks the entire journey—from initial redirect and parameter handling (state, nonce, PKCE) through token exchange, claim mapping, and ultimately to the point where an identity or privilege is accepted by the backend service. Use this when the critical task is proving the security and mechanics of the authentication chain.

This specialized skill is designed to analyze complex security flaws involving forced authentication (coercion) and identity relay chains. It guides users to trace and document the complete, minimal path from the initial coercion trigger (e.g., a specific service or protocol edge) through intermediate hops, to the final service that accepts the relayed credentials. Use this for deep security research, forensics, and documenting the decisive sequence leading to privilege escalation or code execution.

A comprehensive security assessment skill for identifying vulnerabilities in federated identity systems, including SAML, OIDC, and OAuth 2.0 flows. It covers common misconfigurations, such as signature tampering, PKCE failures, redirect URI issues, and token confusion, ensuring robust SSO implementation.