EIDFED-003: Federation Signing Certificate Issuer/Subject Mismatch
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Federation & Hybrid Identity
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
A mismatch between the issuer and subject fields of a federation signing certificate is a strong indicator of a potential Golden SAML attack, where an attacker has replaced the legitimate signing certificate with one they control. In a Golden SAML attack, the attacker generates a self-signed certificate with arbitrary issuer/subject values and configures it as the federation trust signing certificate, enabling them to forge SAML tokens for any user. Any issuer/subject mismatch that does not align with the expected certificate authority chain requires immediate investigation.
Valor recomendado
Federation signing certificate issuer and subject fields match expected organizational PKI chain with no unexpected self-signed certificates
Remediación
Extract the signing certificate from each federated domain trust and compare the issuer and subject fields against your expected organizational PKI hierarchy. Investigate any certificates where the issuer does not match your known certificate authority or where the subject contains unexpected values. If a mismatch is detected, treat this as a potential security incident, rotate the federation signing certificate immediately, and review audit logs for unauthorized federation configuration changes.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(2)
- MITRE ATT&CK
- T1556.006