Unverified50% confidenceSolutionExact time
When integrating SAML, one should strictly validate the signature scope of assertions, audience restrictions, validity time windows, and IdP origin.
1
Sources
50%
Confidence
Long-term
Relevance
9/22/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe SAML authentication flow is divided into two modes, SP-Initiated and IdP-Initiated, with the former being more secure because it includes an InResponseTo check to prevent replay attacks.66% similarUnverifiedWhen an RP validates a logout token, it must check that iss matches, aud contains its own client ID, iat is within a reasonable window (±5 minutes is recommended), and extract sid or sub to locate the session.59% similarUnverifiedAny penetration test must have a written authorization agreement that clearly specifies the testing scope, time window, and permitted technical means58% similarUnverifiedDownstream applications must actively verify the validity of the grant, including checking whether it was issued by a trusted IdP, whether it targets the current application, whether it is within its validity period, and whether the access scope is consistent.57% similarUnverifiedDeprovisioning reconciliation tasks should be idempotent, and deprovisioning operations must be recorded in audit logs to meet the access control change tracking requirements of compliance frameworks such as SOC 2 and ISO 27001.57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/942001API
curl https://kongchang.com/api/v1/knowledge/claims/942001MCP
get_claim(id=942001)