SSO Security Assessment
Most SSO configurations are reviewed once at deployment, then never again. Contractors move on. Conditional Access policies accumulate exceptions. Legacy authentication persists. We provide the systematic, adversarial review your team cannot objectively conduct on infrastructure they built, and produce CREST-accredited evidence your auditors will accept.
Why your pen test did not test your SSO.
Standard penetration tests treat SSO as a black box. They test the login form, not the protocols behind it. Golden SAML, PKCE downgrade, and Conditional Access logic gaps require specialist methodology.
Identity Risk Profile
Identity is now the primary attack vector. The cost of an SSO assessment is a fraction of the cost of the breach it prevents.
Identity at the Root
Of breaches involve compromised credentials used against improperly configured SSO or MFA bypass mechanisms.
Average Federated Estate
Average number of SaaS applications federated to a single enterprise IdP. Every SSO misconfiguration creates exposure across your entire application estate.
Assessment Starting Price
Full SSO security assessment with Golden SAML testing, Conditional Access review, and remediation roadmap. Less than one day of incident response.
Controls
Who Commissions an SSO Assessment?
SSO security assessments are typically triggered by one of these six scenarios. If any of these apply, you are in the right place.
Compliance or Audit Gap
Your ISO 27001, PCI DSS, or cyber insurance renewal has specifically asked for evidence that SSO and identity controls have been independently reviewed. Your annual pen test did not cover it.
Configuration Confidence Crisis
SSO was deployed 12-18 months ago by a contractor or MSP. The configuration has never been independently reviewed. Conditional Access policies have exclusions no one fully understands.
Customer Due Diligence
A bank, public sector client, or enterprise customer is demanding independent security assessment of your OAuth 2.0 or SAML implementation before contract renewal. The deadline is real.
Post-Breach Identity Review
A recent incident involved compromised credentials, OAuth consent grant abuse, or MFA bypass. The board wants proof that the identity layer has been hardened and independently verified.
MFA Bypass Concern
You suspect legacy authentication protocols, stale Conditional Access exclusions, or service accounts are creating MFA bypass paths. You need an independent assessment to confirm.
M&A or IdP Migration
You are migrating from ADFS to Entra ID, merging tenants after an acquisition, or consolidating identity providers. You need assurance the new configuration is secure before cutover.
SSO Vulnerabilities Scanners Cannot Find
Anonymised examples from recent SSO security assessments. These are protocol-level vulnerabilities in SAML, OAuth 2.0, and OpenID Connect implementations that require manual testing to identify and exploit.
XML Signature Wrapping Bypass
The Service Provider validates the XML signature but processes a different, unsigned assertion injected alongside it. We relocate the signed element and inject a forged assertion that the SP accepts as authenticated.
Redirect URI Manipulation Leading to Token Theft
The authorisation server accepts wildcard or subdirectory redirect URIs, allowing an attacker to register a URI under their control and intercept the authorisation code during the OAuth flow.
SAML Assertion Replay Accepted
The Service Provider does not enforce one-time use on SAML assertions. A captured assertion can be replayed minutes or hours later from a different IP to establish a new authenticated session.
PKCE Downgrade to Implicit Flow
The authorisation server accepts requests without a code_challenge parameter on endpoints that should enforce PKCE, allowing an attacker to downgrade to implicit flow and capture tokens from the URL fragment.
JWT Algorithm Confusion (alg:none)
The application accepts ID tokens with the algorithm header set to "none" or accepts HMAC-signed tokens using the RSA public key as the HMAC secret, bypassing signature verification entirely.
SSO Session Not Terminated on Logout
Logging out of the application destroys the local session but does not trigger Single Logout (SLO) at the IdP. The SSO session remains active, and re-visiting the application silently re-authenticates the user.
SSO Assessment Methodology:
Protocol-Level Testing
We go beyond automated configuration scanning. Our consultants manually trace Conditional Access policy logic, simulate Golden SAML attacks, and audit OAuth consent grants, finding the misconfigurations that tools miss and that generalist penetration tests do not cover.
OAuth 2.0 & OIDC Flow Analysis
Testing authorisation code flows for redirect URI manipulation, authorisation code interception, PKCE downgrade attacks, and scope escalation. We also test implicit flow deprecation enforcement, token leakage via Referer headers, and OIDC token validation failures, including alg:none substitution and missing audience checks.
SAML XML Security
Testing SAML implementations for XML Signature Wrapping (including comment injection variants), XXE injection, assertion replay, signature stripping, and Golden SAML attacks targeting ADFS token signing. We decode and manipulate live SAML assertions using protocol-specific tooling to verify that every assertion is correctly signed, encrypted, and validated.
Token Storage & Lifecycle
Analysing how Access, Refresh, and ID tokens are stored (cookies vs localStorage) and validated. We verify token expiration enforcement, rotation policies, and revocation mechanisms, testing whether tokens remain valid after logout and whether refresh token rotation is enforced.
Identity Provider Configuration
Read-only audit of your IdP tenant: Entra ID, Okta, Auth0, or PingIdentity. We review Conditional Access policies for gaps, identify excessive Global Admin and Privileged Role assignments, check whether legacy authentication protocols remain enabled, and audit app registrations for over-broad API permissions.
Social Login Integration
Testing trust relationships and account linkage logic for social authentication (Sign in with Google, Apple, Microsoft). We attempt to hijack accounts via email address spoofing, test whether the application correctly validates the IdP assertion before creating or linking an account, and verify that social login cannot bypass MFA requirements.
Conditional Access Policy Review
We map every Conditional Access policy, including inclusions, exclusions, conditions, and grant controls, to identify logic gaps that allow unintended access. Common findings include exclusion groups that have been silently depopulated, Basic Auth bypass for service accounts, and sign-in risk policies stuck in report-only mode.
How Our SSO Assessment Works
Passive configuration review. No write access, no downtime risk. Read-only audit with adversarial protocol testing.
Architecture Review
A 30-minute scoping call followed by a review of your authentication architecture and IdP configuration diagrams. We establish which protocols are in use (SAML 2.0, OAuth 2.0, OIDC), how many integrations are in scope, and whether IdP tenant audit access is required.
Configuration Audit
We request read-only Global Reader or Security Reader access to your IdP tenant. No write access, no administrator privileges, no production credentials. We audit app registrations, Conditional Access policies, admin role assignments, and legacy authentication settings.
Dynamic Protocol Testing
Intercepting and manipulating live authentication traffic. We attempt redirect URI manipulation to intercept authorisation codes, PKCE downgrade to force implicit flow, SAML XML signature wrapping to forge assertions, and token replay using captured session tokens.
Reporting & Hardening
We deliver a prioritised remediation roadmap mapping every finding to CVSS severity, compliance framework reference, and admin portal click-path instructions so your team can begin remediation on day one. A re-test is included to verify remediation of critical and high findings.
What You Get
Every SSO security assessment includes the following deliverables, structured for auditor review, board presentation, and compliance evidence submission.
Reports are delivered via our real-time penetration testing portal with role-based access. Also available in PDF and DOCX formats. Assessment window re-testing included at no additional cost.
Close the Loop.
After the Test.
An SSO assessment hardens your identity configuration today. These services extend protection continuously: monitoring for identity-based attacks, testing the Active Directory behind the SSO, and securing the web applications that consume the tokens.
Scope a Combined EngagementIdentity Threat Detection
Continuous monitoring for suspicious sign-in activity, Conditional Access policy changes, and OAuth consent abuse.
Active Directory Assessment
If your on-premises AD syncs to Entra ID, evaluate the full hybrid identity attack path from domain controller to cloud.
Web Application Pentest
Test the applications that consume SSO tokens for session handling, access control, and business logic vulnerabilities.
24/7 SOC Monitoring
Continuous monitoring for credential compromise, lateral movement, and identity-based attack patterns.
Full Penetration Testing Catalogue
Comprehensive penetration testing services tailored to your environment.
Internal Testing
Post-perimeter assessments targeting Active Directory, lateral movement, privilege escalation, and segmentation validation from inside your network.
The best time to test your defences is now.
Join the high-growth companies relying on Precursor for continuous offensive and defensive security.
Frequently Asked Questions
Common questions about this service, methodologies, and deliverables.
An SSO security assessment is a specialist security review of your Single Sign-On implementation, covering the protocols (SAML 2.0, OAuth 2.0, OpenID Connect), the Identity Provider configuration, and the trust relationships between your IdP and connected applications. Because SSO acts as a master key (one compromised session grants access to every connected system) it requires dedicated testing that goes beyond what a standard web application penetration test covers. Our assessments are delivered by CREST-accredited testers with specialist expertise in identity protocols.
No. We request read-only Global Reader or Security Reader access to your IdP tenant. We never require write access, administrator privileges, or production environment credentials. All access is scoped to configuration export only and can be revoked immediately after the assessment. This means there is zero risk of accidental configuration changes during testing.
A standard penetration test treats the Identity Provider as trusted infrastructure and tests login at the surface level, typically the login form, session cookies, and basic authentication bypass. An SSO security assessment goes deeper: we intercept and manipulate live SAML assertions and OAuth token exchanges, audit your IdP tenant configuration directly (read-only access to Entra ID / Okta), and test specific protocol attack paths including SAML signature wrapping, PKCE downgrade, redirect URI manipulation, and Golden SAML. The result is a specialist report evidencing protocol-level testing, the kind a PCI DSS QSA or ISO 27001 auditor will accept as substantive coverage of your identity controls.
Single sign-on is both a security improvement and a security concentration. SSO eliminates password sprawl and enables centralised MFA enforcement, reducing overall attack surface. However, it also creates a high-value target: a misconfigured SSO implementation can give an attacker authenticated access to every federated application simultaneously. The risk is not in SSO itself but in the configuration: Conditional Access policy gaps, legacy authentication bypass, unsigned SAML assertions, and overpermissioned OAuth consent grants are the vulnerabilities that turn SSO from a security control into a liability. An independent SSO security assessment identifies precisely these misconfigurations before an attacker does.
The six most important SSO security best practices are: (1) Block legacy authentication protocols (Basic Auth, SMTP AUTH) at the Conditional Access layer, as legacy protocols bypass MFA entirely. (2) Enforce MFA for all users without exception, including service accounts and emergency access accounts. (3) Review OAuth consent grants regularly and revoke any application with Mail.Read, Files.ReadWrite, or directory access that has not been explicitly approved by an administrator. (4) Audit Conditional Access exclusion groups, as stale exclusions from IT projects commonly create persistent MFA bypass paths. (5) Enforce SAML assertion signing with SHA-256 minimum, as unsigned or weakly signed assertions are vulnerable to Golden SAML attacks. (6) Commission an independent SSO security assessment annually or after significant identity infrastructure changes.
Our SAML testing covers XML signature wrapping (including comment injection variants), XML External Entity (XXE) injection, SAML assertion replay attacks, signature stripping, assertion encryption weaknesses, and Golden SAML attacks targeting ADFS token signing certificates. We use protocol-specific tooling including SAML Raider to manipulate live assertions during dynamic testing.
Our OAuth 2.0 and OIDC testing covers: redirect URI manipulation leading to authorisation code interception, PKCE downgrade attacks (forcing implicit flow on PKCE-protected endpoints), token leakage via Referer headers and browser history, scope escalation via over-permissioned client registrations, authorisation code replay (missing state and nonce validation), and OIDC token validation failures including alg:none substitution and missing audience checks.
A Conditional Access policy review is a systematic audit of the logic governing when and how users are permitted to access your Microsoft 365 or Entra ID-protected resources. Our review maps every policy, including inclusions, exclusions, conditions, and grant controls, to identify logic gaps that allow unintended access. Common findings include: policies with exclusion groups that have been silently depopulated, legacy authentication bypass for service accounts that were excluded temporarily and never re-included, sign-in risk policies in report-only mode rather than enforcement mode, and emergency access accounts excluded from all policies without compensating monitoring controls. The review produces a prioritised list of policy changes with exact admin portal click-path instructions.
We have extensive experience auditing Microsoft Entra ID (Azure AD), Okta, Auth0 (Okta CIC), PingIdentity, and Google Workspace. We review both the tenant-level configuration and the specific application registrations. We also assess custom Identity Providers built on IdentityServer4, Keycloak, or other OpenID Connect-compliant frameworks.
Yes. Our assessment produces a structured technical report suitable for submission to a PCI DSS QSA as evidence that SSO and authentication controls within cardholder data environment scope have been independently tested. For ISO 27001, findings map to Annex A.5.15 (Access Control), Annex A.8.2 (Privileged Access Rights), and Annex A.8.5 (Secure Authentication). For Cyber Essentials Plus, the report provides evidence of MFA enforcement and access control testing. We can provide a supplementary compliance mapping document on request.
Yes. We verify that Multi-Factor Authentication is correctly enforced through Conditional Access policies and cannot be bypassed via legacy authentication protocols (Basic Auth, NTLM), device compliance exceptions, or logic flaws in the application post-SSO session handling. We specifically test whether MFA can be bypassed by replaying a session established before MFA was added to the Conditional Access policy.
Engagements typically range from 2 to 5 days depending on the number of SSO integrations in scope, the protocols in use, and whether full IdP tenant audit access is included. We provide a fixed-scope quote following a 30-minute scoping call at no charge.
Several UK compliance frameworks now explicitly require or strongly imply independent identity security testing. ISO 27001:2022 Annex A.5.15, A.8.2, and A.8.5 require organisations to demonstrate that access control measures, including SSO and MFA, have been reviewed and tested. PCI DSS v4.0 Requirement 8 mandates multi-factor authentication for all access into the cardholder data environment, with evidence of MFA enforcement review. The NHS DSPT requires evidence of access control testing under its Identity and Access Management data security standard. Cyber Essentials Plus requires technical verification of MFA controls. Our CREST-accredited assessment report is structured to provide compliance-ready evidence across all of these frameworks.