Do not trust me: Using malicious IdPs for analyzing and attacking Single Sign-On

Christian Mainka, Vladislav Mladenov, Jörg Schwenk

Single Sign-On (SSO) systems simplify login procedures by using an an Identity Provider (IdP) to issue authentication tokens which can be consumed by Service Providers (SPs). Tradi…