[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADYBTWH36MBJMFM023SJJS":3,"skill-same:01M6ADYBTWH36MBJMFM023SJJS":157},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":89,"repositoryHtmlUrl":90,"repositoryHomepageUrl":91,"ownerHtmlUrl":92,"ownerBlogUrl":93,"ownerDescription":94,"updatedAt":95,"install":96,"resources":109},"01M6ADYBTWH36MBJMFM023SJJS","building-identity-federation-with-saml-azure-ad",null,"Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"building identity federation with saml azure ad","identity","azure","authentication","hybrid-identity","sso","federation","saml","adfs","azure-ad","entra-id","fs","directory","pr","entra id","architecture","sync","auth","microsoft","cybersecurity","2026-11-10 10:12:30",false,"---\nname: building-identity-federation-with-saml-azure-ad\ndescription: Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- saml\n- azure-ad\n- entra-id\n- federation\n- identity\n- sso\n- adfs\n- hybrid-identity\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1606.002\n- T1556.007\n- T1484.002\n- T1078.004\n- T1110.003\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  techniques:\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n  - id: F1006.002\n    name: 'Account Takeover: Exposed Login Credential'\n    tactic: initial-access\n    source: f3\n  - id: T1110.003\n    name: 'Brute Force: Password Spraying'\n    tactic: initial-access\n    source: attack\n  - id: T1550\n    name: Use Alternate Authentication Material\n    tactic: initial-access\n    source: attack\n  - id: F1004\n    name: Access with Stolen Session Cookie\n    tactic: initial-access\n    source: f3\n---\n\n# Building Identity Federation with SAML Azure AD\n\n## Overview\n\nIdentity federation enables users authenticated by one identity provider to access resources managed by another without maintaining separate credentials. This skill covers establishing SAML 2.0 federation between an organization's on-premises Active Directory (via AD FS or third-party IdP) and Microsoft Entra ID (formerly Azure AD), as well as configuring federated SSO for third-party SaaS applications. Federation eliminates password synchronization concerns and keeps authentication authority on-premises while extending SSO to cloud resources.\n\n\n## When to Use\n\n- When deploying or configuring building identity federation with saml azure ad capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- On-premises Active Directory domain\n- AD FS 2019+ or third-party SAML IdP (Okta, Ping, etc.)\n- Microsoft Entra ID tenant (P1 or P2 license recommended)\n- Azure AD Connect (if using hybrid identity with password hash sync as backup)\n- Public TLS certificate for federation endpoint\n- DNS records for federation service name\n\n## Core Concepts\n\n### Federation Models\n\n| Model | Authentication Authority | Use Case |\n|-------|------------------------|----------|\n| Federated (AD FS) | On-premises AD FS | Regulatory requirement to keep auth on-prem |\n| Managed (PHS) | Azure AD with password hash sync | Simplest cloud auth, AD FS not needed |\n| Managed (PTA) | On-premises via pass-through agent | Cloud auth validated against on-prem AD |\n| Third-Party Federation | External IdP (Okta, Ping) | Multi-IdP environment |\n\n### SAML Federation Architecture\n\n```\nUser → Cloud App (SP)\n   │\n   └── Redirect to Azure AD\n          │\n          ├── Azure AD checks federated domain\n          │\n          └── Redirect to on-premises AD FS\n                 │\n                 ├── AD FS authenticates against Active Directory\n                 │\n                 ├── AD FS issues SAML token\n                 │\n                 └── Token posted back to Azure AD\n                        │\n                        ├── Azure AD validates federation trust\n                        │\n                        ├── Azure AD issues its own token\n                        │\n                        └── User receives access token for cloud app\n```\n\n### Federation Trust Components\n\n| Component | Description |\n|-----------|-------------|\n| Token-Signing Certificate | X.509 certificate used by IdP to sign SAML assertions |\n| Federation Metadata | XML document describing IdP endpoints and capabilities |\n| Relying Party Trust | Configuration in AD FS for each SP (Azure AD) |\n| Claims Rules | Transform AD attributes into SAML claims |\n| Issuer URI | Unique identifier for the IdP (entity ID) |\n\n## Workflow\n\n### Step 1: Prepare AD FS Infrastructure\n\n```powershell\n# Install AD FS role\nInstall-WindowsFeature ADFS-Federation -IncludeManagementTools\n\n# Configure AD FS farm\nInstall-AdfsFarm `\n    -CertificateThumbprint $certThumbprint `\n    -FederationServiceDisplayName \"Corp Federation Service\" `\n    -FederationServiceName \"fs.corp.example.com\" `\n    -ServiceAccountCredential $gmsaCredential\n\n# Verify AD FS is operational\nGet-AdfsProperties | Select-Object HostName, Identifier, FederationPassiveAddress\n```\n\n### Step 2: Configure Azure AD Federated Domain\n\n```powershell\n# Install Microsoft Graph PowerShell module\nInstall-Module Microsoft.Graph -Scope CurrentUser\n\n# Connect to Microsoft Graph\nConnect-MgGraph -Scopes \"Domain.ReadWrite.All\"\n\n# Convert managed domain to federated\n# Using AD FS federation metadata URL\n$domainId = \"corp.example.com\"\n$federationConfig = @{\n    issuerUri = \"http:\u002F\u002Ffs.corp.example.com\u002Fadfs\u002Fservices\u002Ftrust\"\n    metadataExchangeUri = \"https:\u002F\u002Ffs.corp.example.com\u002Fadfs\u002Fservices\u002Ftrust\u002Fmex\"\n    passiveSignInUri = \"https:\u002F\u002Ffs.corp.example.com\u002Fadfs\u002Fls\u002F\"\n    signOutUri = \"https:\u002F\u002Ffs.corp.example.com\u002Fadfs\u002Fls\u002F?wa=wsignout1.0\"\n    signingCertificate = $base64Cert\n    preferredAuthenticationProtocol = \"saml\"\n}\n\n# Apply federation settings to domain\nNew-MgDomainFederationConfiguration -DomainId $domainId -BodyParameter $federationConfig\n```\n\n### Step 3: Configure AD FS Claims Rules\n\n```powershell\n# Add Relying Party Trust for Azure AD\nAdd-AdfsRelyingPartyTrust `\n    -Name \"Microsoft Office 365 Identity Platform\" `\n    -MetadataUrl \"https:\u002F\u002Fnexus.microsoftonline-p.com\u002Ffederationmetadata\u002F2007-06\u002Ffederationmetadata.xml\"\n\n# Configure claim rules\n$rules = @\"\n@RuleTemplate = \"LdapClaims\"\n@RuleName = \"Extract AD Attributes\"\nc:[Type == \"http:\u002F\u002Fschemas.microsoft.com\u002Fws\u002F2008\u002F06\u002Fidentity\u002Fclaims\u002Fwindowsaccountname\",\n   Issuer == \"AD AUTHORITY\"]\n=> issue(store = \"Active Directory\",\n   types = (\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fclaims\u002FUPN\",\n            \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaims\u002Femailaddress\",\n            \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaims\u002Fgivenname\",\n            \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaims\u002Fsurname\"),\n   query = \";userPrincipalName,mail,givenName,sn;{0}\",\n   param = c.Value);\n\n@RuleTemplate = \"PassThroughClaims\"\n@RuleName = \"Pass Through UPN as NameID\"\nc:[Type == \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fclaims\u002FUPN\"]\n=> issue(Type = \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaims\u002Fnameidentifier\",\n   Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer,\n   Value = c.Value,\n   ValueType = c.ValueType,\n   Properties[\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaimproperties\u002Fformat\"]\n       = \"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\");\n\"@\n\nSet-AdfsRelyingPartyTrust `\n    -TargetName \"Microsoft Office 365 Identity Platform\" `\n    -IssuanceTransformRules $rules\n```\n\n### Step 4: Configure Third-Party SaaS Federation\n\nFor each SaaS application that supports SAML SSO via Azure AD:\n\n1. Navigate to Microsoft Entra Admin Center > Enterprise Applications\n2. Add the application from the gallery (or create custom SAML)\n3. Configure Single Sign-On > SAML:\n   - Identifier (Entity ID): Application's entity ID\n   - Reply URL (ACS): Application's assertion consumer service URL\n   - Sign-on URL: Application's login URL\n4. Map user attributes\u002Fclaims:\n   - NameID: user.userprincipalname (email format)\n   - Additional claims as required by the application\n5. Download the Federation Metadata XML or certificate\n6. Configure the SaaS app with Azure AD's federation details\n\n### Step 5: Certificate Lifecycle Management\n\nAD FS token-signing certificates expire and must be renewed:\n\n```powershell\n# Check current certificate expiration\nGet-AdfsCertificate -CertificateType Token-Signing | Select-Object Thumbprint, NotAfter\n\n# AD FS supports auto-rollover (enabled by default)\nGet-AdfsProperties | Select-Object AutoCertificateRollover\n\n# If manual rotation is needed:\n# 1. Add new certificate as secondary\nSet-AdfsCertificate -CertificateType Token-Signing -Thumbprint $newThumbprint -IsPrimary $false\n# 2. Update Azure AD with new certificate\n# 3. Promote to primary\nSet-AdfsCertificate -CertificateType Token-Signing -Thumbprint $newThumbprint -IsPrimary $true\n# 4. Remove old certificate\nRemove-AdfsCertificate -CertificateType Token-Signing -Thumbprint $oldThumbprint\n```\n\n## Validation Checklist\n\n- [ ] AD FS farm operational with valid TLS and token-signing certificates\n- [ ] Azure AD domain configured as federated with correct metadata\n- [ ] Claims rules properly transform AD attributes to SAML assertions\n- [ ] Test user can authenticate through federation flow end-to-end\n- [ ] MFA enforced at AD FS or Azure AD conditional access level\n- [ ] Certificate auto-rollover enabled or manual rotation scheduled\n- [ ] Federation metadata endpoint publicly accessible\n- [ ] Smart lockout configured to prevent brute force\n- [ ] Extranet lockout policies configured on AD FS\n- [ ] Monitoring configured for AD FS health and certificate expiry\n- [ ] Disaster recovery: managed authentication fallback documented\n\n## References\n\n- [Microsoft Entra Federation Documentation](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fhybrid\u002Fconnect\u002Fwhatis-fed)\n- [AD FS Design Guide](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fidentity\u002Fad-fs\u002Fdesign\u002Fad-fs-design-guide)\n- [Configure AD FS for Azure AD Federation](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fhybrid\u002Fconnect\u002Fhow-to-connect-fed-management)\n- [SAML 2.0 Authentication - OASIS](https:\u002F\u002Fdocs.oasis-open.org\u002Fsecurity\u002Fsaml\u002Fv2.0\u002F)\n","# Building Identity Federation with SAML Azure AD\n\n## Overview\n\nIdentity federation enables users authenticated by one identity provider to access resources managed by another without maintaining separate credentials. This skill covers establishing SAML 2.0 federation between an organization's on-premises Active Directory (via AD FS or third-party IdP) and Microsoft Entra ID (formerly Azure AD), as well as configuring federated SSO for third-party SaaS applications. Federation eliminates password synchronization concerns and keeps authentication authority on-premises while extending SSO to cloud resources.\n\n\n## When to Use\n\n- When deploying or configuring building identity federation with saml azure ad capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- On-premises Active Directory domain\n- AD FS 2019+ or third-party SAML IdP (Okta, Ping, etc.)\n- Microsoft Entra ID tenant (P1 or P2 license recommended)\n- Azure AD Connect (if using hybrid identity with password hash sync as backup)\n- Public TLS certificate for federation endpoint\n- DNS records for federation service name\n\n## Core Concepts\n\n### Federation Models\n\n| Model | Authentication Authority | Use Case |\n|-------|------------------------|----------|\n| Federated (AD FS) | On-premises AD FS | Regulatory requirement to keep auth on-prem |\n| Managed (PHS) | Azure AD with password hash sync | Simplest cloud auth, AD FS not needed |\n| Managed (PTA) | On-premises via pass-through agent | Cloud auth validated against on-prem AD |\n| Third-Party Federation | External IdP (Okta, Ping) | Multi-IdP environment |\n\n### SAML Federation Architecture\n\n```\nUser → Cloud App (SP)\n   │\n   └── Redirect to Azure AD\n          │\n          ├── Azure AD checks federated domain\n          │\n          └── Redirect to on-premises AD FS\n                 │\n                 ├── AD FS authenticates against Active Directory\n                 │\n                 ├── AD FS issues SAML token\n                 │\n                 └── Token posted back to Azure AD\n                        │\n                        ├── Azure AD validates federation trust\n                        │\n                        ├── Azure AD issues its own token\n                        │\n                        └── User receives access token for cloud app\n```\n\n### Federation Trust Components\n\n| Component | Description |\n|-----------|-------------|\n| Token-Signing Certificate | X.509 certificate used by IdP to sign SAML assertions |\n| Federation Metadata | XML document describing IdP endpoints and capabilities |\n| Relying Party Trust | Configuration in AD FS for each SP (Azure AD) |\n| Claims Rules | Transform AD attributes into SAML claims |\n| Issuer URI | Unique identifier for the IdP (entity ID) |\n\n## Workflow\n\n### Step 1: Prepare AD FS Infrastructure\n\n```powershell\n# Install AD FS role\nInstall-WindowsFeature ADFS-Federation -IncludeManagementTools\n\n# Configure AD FS farm\nInstall-AdfsFarm `\n    -CertificateThumbprint $certThumbprint `\n    -FederationServiceDisplayName \"Corp Federation Service\" `\n    -FederationServiceName \"fs.corp.example.com\" `\n    -ServiceAccountCredential $gmsaCredential\n\n# Verify AD FS is operational\nGet-AdfsProperties | Select-Object HostName, Identifier, FederationPassiveAddress\n```\n\n### Step 2: Configure Azure AD Federated Domain\n\n```powershell\n# Install Microsoft Graph PowerShell module\nInstall-Module Microsoft.Graph -Scope CurrentUser\n\n# Connect to Microsoft Graph\nConnect-MgGraph -Scopes \"Domain.ReadWrite.All\"\n\n# Convert managed domain to federated\n# Using AD FS federation metadata URL\n$domainId = \"corp.example.com\"\n$federationConfig = @{\n    issuerUri = \"http:\u002F\u002Ffs.corp.example.com\u002Fadfs\u002Fservices\u002Ftrust\"\n    metadataExchangeUri = \"https:\u002F\u002Ffs.corp.example.com\u002Fadfs\u002Fservices\u002Ftrust\u002Fmex\"\n    passiveSignInUri = \"https:\u002F\u002Ffs.corp.example.com\u002Fadfs\u002Fls\u002F\"\n    signOutUri = \"https:\u002F\u002Ffs.corp.example.com\u002Fadfs\u002Fls\u002F?wa=wsignout1.0\"\n    signingCertificate = $base64Cert\n    preferredAuthenticationProtocol = \"saml\"\n}\n\n# Apply federation settings to domain\nNew-MgDomainFederationConfiguration -DomainId $domainId -BodyParameter $federationConfig\n```\n\n### Step 3: Configure AD FS Claims Rules\n\n```powershell\n# Add Relying Party Trust for Azure AD\nAdd-AdfsRelyingPartyTrust `\n    -Name \"Microsoft Office 365 Identity Platform\" `\n    -MetadataUrl \"https:\u002F\u002Fnexus.microsoftonline-p.com\u002Ffederationmetadata\u002F2007-06\u002Ffederationmetadata.xml\"\n\n# Configure claim rules\n$rules = @\"\n@RuleTemplate = \"LdapClaims\"\n@RuleName = \"Extract AD Attributes\"\nc:[Type == \"http:\u002F\u002Fschemas.microsoft.com\u002Fws\u002F2008\u002F06\u002Fidentity\u002Fclaims\u002Fwindowsaccountname\",\n   Issuer == \"AD AUTHORITY\"]\n=> issue(store = \"Active Directory\",\n   types = (\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fclaims\u002FUPN\",\n            \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaims\u002Femailaddress\",\n            \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaims\u002Fgivenname\",\n            \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaims\u002Fsurname\"),\n   query = \";userPrincipalName,mail,givenName,sn;{0}\",\n   param = c.Value);\n\n@RuleTemplate = \"PassThroughClaims\"\n@RuleName = \"Pass Through UPN as NameID\"\nc:[Type == \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fclaims\u002FUPN\"]\n=> issue(Type = \"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaims\u002Fnameidentifier\",\n   Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer,\n   Value = c.Value,\n   ValueType = c.ValueType,\n   Properties[\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaimproperties\u002Fformat\"]\n       = \"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\");\n\"@\n\nSet-AdfsRelyingPartyTrust `\n    -TargetName \"Microsoft Office 365 Identity Platform\" `\n    -IssuanceTransformRules $rules\n```\n\n### Step 4: Configure Third-Party SaaS Federation\n\nFor each SaaS application that supports SAML SSO via Azure AD:\n\n1. Navigate to Microsoft Entra Admin Center > Enterprise Applications\n2. Add the application from the gallery (or create custom SAML)\n3. Configure Single Sign-On > SAML:\n   - Identifier (Entity ID): Application's entity ID\n   - Reply URL (ACS): Application's assertion consumer service URL\n   - Sign-on URL: Application's login URL\n4. Map user attributes\u002Fclaims:\n   - NameID: user.userprincipalname (email format)\n   - Additional claims as required by the application\n5. Download the Federation Metadata XML or certificate\n6. Configure the SaaS app with Azure AD's federation details\n\n### Step 5: Certificate Lifecycle Management\n\nAD FS token-signing certificates expire and must be renewed:\n\n```powershell\n# Check current certificate expiration\nGet-AdfsCertificate -CertificateType Token-Signing | Select-Object Thumbprint, NotAfter\n\n# AD FS supports auto-rollover (enabled by default)\nGet-AdfsProperties | Select-Object AutoCertificateRollover\n\n# If manual rotation is needed:\n# 1. Add new certificate as secondary\nSet-AdfsCertificate -CertificateType Token-Signing -Thumbprint $newThumbprint -IsPrimary $false\n# 2. Update Azure AD with new certificate\n# 3. Promote to primary\nSet-AdfsCertificate -CertificateType Token-Signing -Thumbprint $newThumbprint -IsPrimary $true\n# 4. Remove old certificate\nRemove-AdfsCertificate -CertificateType Token-Signing -Thumbprint $oldThumbprint\n```\n\n## Validation Checklist\n\n- [ ] AD FS farm operational with valid TLS and token-signing certificates\n- [ ] Azure AD domain configured as federated with correct metadata\n- [ ] Claims rules properly transform AD attributes to SAML assertions\n- [ ] Test user can authenticate through federation flow end-to-end\n- [ ] MFA enforced at AD FS or Azure AD conditional access level\n- [ ] Certificate auto-rollover enabled or manual rotation scheduled\n- [ ] Federation metadata endpoint publicly accessible\n- [ ] Smart lockout configured to prevent brute force\n- [ ] Extranet lockout policies configured on AD FS\n- [ ] Monitoring configured for AD FS health and certificate expiry\n- [ ] Disaster recovery: managed authentication fallback documented\n\n## References\n\n- [Microsoft Entra Federation Documentation](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fhybrid\u002Fconnect\u002Fwhatis-fed)\n- [AD FS Design Guide](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fidentity\u002Fad-fs\u002Fdesign\u002Fad-fs-design-guide)\n- [Configure AD FS for Azure AD Federation](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fhybrid\u002Fconnect\u002Fhow-to-connect-fed-management)\n- [SAML 2.0 Authentication - OASIS](https:\u002F\u002Fdocs.oasis-open.org\u002Fsecurity\u002Fsaml\u002Fv2.0\u002F)\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"mitre_f3":52,"nist_csf":75,"subdomain":80,"description":7,"mitre_attack":81},[31,33,34,30,25,29,32,28],"mahipal","1.0",{"tactics":53,"version":56,"techniques":57},[54,55],"initial-access","positioning","1.1",[58,62,65,69,72],{"id":59,"name":60,"source":61,"tactic":54},"F1006","Account Takeover","f3",{"id":63,"name":64,"source":61,"tactic":54},"F1006.002","Account Takeover: Exposed Login Credential",{"id":66,"name":67,"source":68,"tactic":54},"T1110.003","Brute Force: Password Spraying","attack",{"id":70,"name":71,"source":68,"tactic":54},"T1550","Use Alternate Authentication Material",{"id":73,"name":74,"source":61,"tactic":54},"F1004","Access with Stolen Session Cookie",[76,77,78,79],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management",[82,83,84,85,66],"T1606.002","T1556.007","T1484.002","T1078.004","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbuilding-identity-federation-with-saml-azure-ad",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":97,"prompt":107,"zipAvailable":108},[98,101,104],{"tool":99,"command":100},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-identity-federation-with-saml-azure-ad",{"tool":102,"command":103},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-identity-federation-with-saml-azure-ad",{"tool":105,"command":106},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-identity-federation-with-saml-azure-ad","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002FSKILL.md",true,[110,116,120,125,131,135,139,143,149,153],{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"assets\u002Fexample_asset.txt","ASSET","资产文件",865,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fgdpr-dsgvo-expert\u002Fassets\u002Fexample_asset.txt",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"assets\u002Ftemplate.md",1576,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002Fassets\u002Ftemplate.md",{"path":121,"resourceType":121,"resourceTypeDesc":122,"sizeBytes":123,"sourceHtmlUrl":124},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002FLICENSE",{"path":126,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":129,"sourceHtmlUrl":130},"references\u002Fapi_reference.md","REFERENCE","参考文档",968,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fgdpr-dsgvo-expert\u002Freferences\u002Fapi_reference.md",{"path":132,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fapi-reference.md",1598,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002Freferences\u002Fapi-reference.md",{"path":136,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Fstandards.md",1761,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002Freferences\u002Fstandards.md",{"path":140,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":141,"sourceHtmlUrl":142},"references\u002Fworkflows.md",4439,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002Freferences\u002Fworkflows.md",{"path":144,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":147,"sourceHtmlUrl":148},"scripts\u002Fagent.py","SCRIPT","脚本",4516,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002Fscripts\u002Fagent.py",{"path":150,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":151,"sourceHtmlUrl":152},"scripts\u002Fexample.py",593,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fgdpr-dsgvo-expert\u002Fscripts\u002Fexample.py",{"path":154,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":155,"sourceHtmlUrl":156},"scripts\u002Fprocess.py",8427,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-identity-federation-with-saml-azure-ad\u002Fscripts\u002Fprocess.py",[158,183,207,235,261,288],{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,167,168,169,170,43,171,25,37,172,173,174,175,176,177,178,179,180,181,182],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":190,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[189],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[191,179,192,193,170,194,43,37,195,196,197,198,199,200,201,202,203,204,205,206],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":217,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[213,216],{"categoryNo":214,"categoryName":215,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[201,218,219,220,221,43,222,223,195,224,225,226,227,228,229,230,231,232,233,234],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[241],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[243,244,245,43,246,247,248,249,250,251,252,253,254,255,256,257,198,258,259,260],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":262,"name":263,"nameZh":6,"description":264,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":265,"categories":266,"keywords":268,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[267],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[269,270,271,43,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":289,"name":290,"nameZh":6,"description":291,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":292,"categories":293,"keywords":295,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[294],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[170,296,43,297,298,299,300,301,302,303,304,230,305,231,306,307,308,309,310,311],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]