Senior Quiz: SSO and Federation¶

OAuth2 access tokens authorize API access. OIDC defines ID tokens, nonce, UserInfo, authentication context, and session/logout conventions used for login. Both OIDC and SAML can produce SSO.

The IdP session enables a prompt-free response to B, but each client normally owns its local session. Sharing an application cookie across unrelated clients expands the trust and compromise boundary.

Logout semantics must distinguish local, RP-initiated/provider, back-channel, SAML SLO, and global outcomes. Partial failure must be visible and documented.

The issuer must come from trusted client configuration. Allowing a token to choose an arbitrary issuer or JWK endpoint creates SSRF and trust-confusion risks.

Signature and expiry prove integrity and freshness only. Audience, issuer, algorithm, and authority mapping are separate decisions the resource server must make.

A public client does not have a secret. state, nonce, and code_verifier prevent CSRF, replay, and authorization-code interception respectively.

kid is an unauthenticated hint for key selection. Only successful verification against trusted material establishes integrity, and trusted key sources must come from server configuration.

Signature validity proves integrity and signer possession, not that the assertion was intended for this relying party, endpoint, request, or time.

A signed claim is only as trustworthy as its source and governance. Authority mapping needs an explicit contract, allow list, normalization, and negative tests for unexpected values.

ID tokens target the client, and SAML assertions target the relying party/ACS flow. APIs require credentials intended for their audience and authorization model.

Rollover is a trust change, not a reason to bypass validation. Emergency replacement and metadata compromise need separate runbooks and audit evidence.