What is abuse of single sign-on or identity federation?¶

Abuse of single sign-on or identity federation occurs when an offender uses a trusted identity relationship to reach several connected services.

Evidential caution: that successful access to several services proves the password was entered separately each time.

What this means¶

Access may rely on:

one identity-provider session;

federated tokens;

application consent;

session cookies;

stolen authentication material;

compromised administrator settings;

misconfigured trust.

which identity provider authenticated the session;

which token or session was used;

which applications accepted it;

what device and source were involved;

whether multi-factor authentication occurred;

whether the trust or application permission changed;

what activity followed.

One compromised identity session may create access across many services.

Likewise, an application log may show a valid federated identity without revealing the original authentication route.

Single sign-on may also obscure the original device because relying applications record only the identity provider or token issuer. Correlate session identifiers, token claims, source addresses and device records across both sides of the trust relationship.

Trace the federated identity from original authentication through token issuance to each relying service, and keep account identity separate from personal control.

================================================================================

What to check or do next¶

• Investigators should establish:
• Preserve identity-provider, application, token, consent and session records.
• Preserve that cross-service linkage carefully. The operational takeaway is:

Evidential limits¶

It may not have been.

Do not assume the account holder personally accessed every application.

Federated access may persist after a password change if tokens or sessions remain valid. Investigators should preserve token issuance, revocation, application consent and sign-out records. Remediating the password alone may not explain or contain every relying-service session.