mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-03 09:20:18 +03:00

Files

T

Mahipal 2fb6a9faff Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

2026-08-02 09:32:13 -07:00

6.6 KiB

Raw Blame History

name, description, domain, subdomain, tags, version, author, license, nist_csf, mitre_attack, mitre_f3

name

description

domain

subdomain

Implementing SAML SSO with Okta

Overview

Implement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration of SAML authentication flows, attribute mapping, certificate management, and security hardening for enterprise SSO deployments.

When to Use

When deploying or configuring implementing saml sso with okta capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with identity access management concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Configure Okta as a SAML 2.0 Identity Provider
Implement SP-initiated and IdP-initiated SSO flows
Map SAML attributes and configure assertion encryption
Enforce SHA-256 signatures and secure certificate rotation
Test SSO flows with SAML tracer tools
Implement Single Logout (SLO) handling

Key Concepts

SAML 2.0 Authentication Flow

SP-Initiated Flow: User accesses Service Provider -> SP generates AuthnRequest -> Redirect to Okta IdP -> User authenticates -> Okta sends SAML Response -> SP validates assertion -> Access granted
IdP-Initiated Flow: User authenticates at Okta -> Selects application -> Okta sends unsolicited SAML Response -> SP validates -> Access granted

Critical Security Requirements

SHA-256 Signatures: All SAML assertions must use SHA-256 (not SHA-1) for digital signatures
Assertion Encryption: Encrypt SAML assertions using AES-256 to protect attribute values in transit
Audience Restriction: Configure audience URI to prevent assertion replay across different SPs
NotBefore/NotOnOrAfter: Enforce time validity windows to prevent stale assertion usage
InResponseTo Validation: Verify assertion corresponds to the original AuthnRequest

Okta Application Configuration

Single Sign-On URL: The ACS (Assertion Consumer Service) endpoint on the SP
Audience URI (SP Entity ID): Unique identifier for the SP
Name ID Format: EmailAddress, Persistent, or Transient
Attribute Statements: Map Okta user profile attributes to SAML assertion attributes
Group Attribute Statements: Include group membership for RBAC

Workflow

Step 1: Create SAML Application in Okta

Navigate to Applications > Create App Integration
Select SAML 2.0 as the sign-on method
Configure General Settings (App Name, Logo)
Set Single Sign-On URL (ACS URL)
Set Audience URI (SP Entity ID)
Configure Name ID Format and Application Username

Step 2: Configure Attribute Mapping

Map user.email to email attribute
Map user.firstName and user.lastName to name attributes
Add group attribute statements for role-based access
Configure attribute value formats (Basic, URI Reference, Unspecified)

Step 3: Download and Install IdP Metadata

Download Okta IdP metadata XML
Extract IdP SSO URL, IdP Entity ID, and X.509 certificate
Install certificate on SP side for signature validation
Configure SP metadata with ACS URL and Entity ID

Step 4: Implement SP-Side SAML Processing

Parse and validate SAML Response XML
Verify digital signature using IdP certificate
Check audience restriction, time conditions, and InResponseTo
Extract authenticated user identity and attributes
Create application session based on assertion data

Step 5: Security Hardening

Enforce SHA-256 for all signature operations
Enable assertion encryption with AES-256-CBC
Configure session timeout and re-authentication policies
Implement SAML artifact binding for sensitive deployments
Set up certificate rotation procedure before expiry

Step 6: Testing and Validation

Use SAML Tracer browser extension for debugging
Validate SP-initiated and IdP-initiated flows
Test with multiple user accounts and group memberships
Verify SLO functionality
Test certificate rotation without downtime

Security Controls

Control	NIST 800-53	Description
Authentication	IA-2	Multi-factor authentication through Okta
Session Management	SC-23	SAML session lifetime controls
Audit Logging	AU-3	Log all SSO authentication events
Certificate Management	SC-17	PKI certificate lifecycle management
Access Enforcement	AC-3	SAML attribute-based access control

Common Pitfalls

Using SHA-1 instead of SHA-256 for SAML signatures
Not validating InResponseTo in SAML responses (replay attacks)
Clock skew between IdP and SP causing assertion rejection
Failing to restrict audience URI allowing assertion forwarding
Not implementing certificate rotation before expiry causes outage

Verification

SAML SSO login completes successfully via SP-initiated flow
IdP-initiated flow correctly authenticates users
SAML assertions use SHA-256 signatures
Attribute mapping correctly populates user profile
Session timeout forces re-authentication
SLO properly terminates sessions on both IdP and SP
Certificate rotation tested without service interruption

6.6 KiB Raw Blame History