Security Threat Modeling for Federated Identity Systems: A STRIDE-Based Assessment of SSO and MFA Vulnerabilities

Abstract

Federated identity systems have become a central mechanism for enabling single sign-on (SSO), multi-application authentication, and multi-factor authentication (MFA) across organizational and service boundaries. Their security value, however, depends not only on the strength of individual authentication mechanisms but also on the integrity of trust relationships, identity assertions, authentication workflows, session management, and federation infrastructure. This research develops a STRIDE-oriented threat-modeling approach for assessing security vulnerabilities in federated SSO and MFA environments. The study adopts a structured analytical methodology consisting of system decomposition, trust-boundary identification, threat categorization, vulnerability assessment, and control mapping. Because the supplied literature is primarily concentrated on statistical modeling, machine learning, financial systems, and explainability rather than federated identity security, the analysis explicitly treats these sources as methodological foundations rather than direct empirical evidence of specific identity attacks. In particular, concepts concerning sequential modeling, uncertainty, smoothing, and black-box explainability are used to inform the analytical structure of threat identification and prioritization. The study finds that federated identity architectures create concentrated security dependencies: compromise of an identity provider, federation endpoint, token-validation mechanism, or MFA workflow can propagate across multiple relying applications. STRIDE analysis further indicates that spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege can occur across different layers of the authentication lifecycle. The research contributes a systematic conceptual model for integrating STRIDE with federated SSO and MFA risk analysis and identifies opportunities for adaptive, explainable, and uncertainty-aware security assessment.