Federation Metadata Collection occurs when attackers systematically retrieve and analyze public or semi-public federation documents to map identity infrastructure. While federation metadata is designed for interoperability, misconfigurations and legacy implementations create reconnaissance opportunities.
SAML Components
Metadata XML documents
Signing certificate fingerprints
Application entity IDs
Service provider endpoints
OIDC Discovery
/.well-known/openid-configuration
Token endpoints
Supported grant types
Authorization URLs
Trust Architecture
Federation trust URLs
Redirect URIs
Claims configuration
Multi-tenant paths
Exposed metadata becomes a blueprint attackers leverage to identify trust chains, detect outdated certificates, and map token infrastructure for subsequent exploitation phases.
🧠 Attacker Objectives & Weaponization
Primary Reconnaissance Goals
Attackers harvest metadata to reverse-engineer federation architecture and identify exploitable trust relationships. This intelligence gathering reveals how identity systems authenticate users, which external IdPs are trusted, and where validation weaknesses exist.
Map federation topology and trust chains
Identify weak or expired signing certificates
Catalog token endpoints for OAuth manipulation
Analyze redirect URIs for phishing vectors
Detect legacy federation integrations
Downstream Attack Enablement
Metadata collection serves as foundational reconnaissance for sophisticated identity attacks. Understanding acceptable claims enables identity forgery, while redirect URI analysis supports credential harvesting campaigns.
Old, expired, or leaked certificates remain trusted in federation configurations, allowing attackers to impersonate legitimate identity providers. Organizations fail to rotate certificates on recommended schedules or properly revoke compromised keys.
MC-146 — Inconsistent Identity Trust Boundaries
Multiple federation paths expose varying metadata sets with different security postures. Legacy integrations coexist with modern implementations, creating inconsistent trust models that attackers probe for weakest-link access.
MC-075 — Weak Network Segmentation for Identity Paths
Federation endpoints lack proper network controls and become globally accessible. Metadata URLs respond to unauthenticated requests without rate limiting, enabling systematic harvesting of identity infrastructure details.
Federation metadata collection occurs during the earliest reconnaissance phases, establishing the foundation for complex identity attacks. Understanding this positioning helps security teams implement preventive controls before exploitation.
1
Stage 1: Reconnaissance
Attackers discover and catalog federation endpoints, metadata URLs, and trust relationships.
2
Stage 2: Identity Enumeration
Harvested metadata enables targeted enumeration of users, claims, and authentication flows.