{"id":12655,"date":"2026-08-28T21:59:25","date_gmt":"2026-08-29T02:59:25","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=12655"},"modified":"2026-11-02T10:04:34","modified_gmt":"2026-11-02T15:04:34","slug":"spire-prove-the-configuration-rejects-abuse-negative-security-testing","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=12655","title":{"rendered":"SPIFFE: Prove the Configuration Rejects Abuse: Negative Security Testing"},"content":{"rendered":"

A security architecture should be judged by rejection behavior, not only by a successful demonstration. Each test below states a precondition, an enforcement point, and evidence to collect. The exact HTTP status or OAuth error depends on the failing stage and implementation; do not require a universal error code where the standards or product do not prescribe one.<\/p>\n

Test environment and positive controls<\/h2>\n

Use isolated non-production identities and resources. Establish a successful standalone call and a successful Lisa\/XYZ delegated call first. Capture the issued token\u2019s approved claims without copying credentials into ordinary logs. Confirm the actual policy version and key material in use. Change one condition per test where possible, and retain request correlation so failures can be attributed to the intended control.<\/p>\n

Where a deployment does not implement a proposed control, mark the corresponding test as an identified gap or accepted risk, not a false pass. Sender-constraint tests require a genuinely supported profile. Task-authorization tests require the resource server to implement that policy.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ID<\/strong><\/td>\nInput or precondition<\/strong><\/td>\nEnforcement point<\/strong><\/td>\nExpected outcome\/evidence<\/strong><\/td>\n<\/tr>\n
01<\/strong><\/td>\nActor token from untrusted issuer<\/td>\nSTS actor validation<\/td>\nReject; log issuer-policy failure<\/td>\n<\/tr>\n
02<\/strong><\/td>\nActor JWT-SVID with wrong STS audience<\/td>\nSTS actor validation<\/td>\nReject; intended-recipient failure<\/td>\n<\/tr>\n
03<\/strong><\/td>\nHuman JWT substituted as actor evidence<\/td>\nSTS profile validation<\/td>\nReject; cross-profile failure<\/td>\n<\/tr>\n
04<\/strong><\/td>\nWorkload JWT substituted as human subject<\/td>\nSTS subject validation<\/td>\nReject; subject-profile failure<\/td>\n<\/tr>\n
05<\/strong><\/td>\nUnsigned or disallowed-algorithm JWT<\/td>\nSTS\/API signature policy<\/td>\nReject; algorithm\/signature failure<\/td>\n<\/tr>\n
06<\/strong><\/td>\nToken with attacker-controlled key URL<\/td>\nConfigured key-resolution boundary<\/td>\nNo outbound trust in supplied URL; reject invalid signature<\/td>\n<\/tr>\n
07<\/strong><\/td>\nExpired input token<\/td>\nSTS time validation<\/td>\nReject; expiration failure<\/td>\n<\/tr>\n
08<\/strong><\/td>\nInput not yet valid outside allowed skew<\/td>\nSTS time validation<\/td>\nReject; temporal-policy failure<\/td>\n<\/tr>\n
09<\/strong><\/td>\nOutput token presented to wrong API<\/td>\nResource audience validation<\/td>\nReject; audience mismatch<\/td>\n<\/tr>\n
10<\/strong><\/td>\nForged act claim on signed token<\/td>\nResource signature validation<\/td>\nReject; modified token<\/td>\n<\/tr>\n
11<\/strong><\/td>\nCaller actor override differs from verified identity<\/td>\nSTS mapping\/policy<\/td>\nReject or ignore override under explicit policy; no forged attribution<\/td>\n<\/tr>\n
12<\/strong><\/td>\nClient\/actor pairing forbidden by policy<\/td>\nSTS relationship policy<\/td>\nReject; pairing decision recorded<\/td>\n<\/tr>\n
13<\/strong><\/td>\nXYZ paired with ineligible Lisa delegation<\/td>\nSTS approval\/pairing policy<\/td>\nReject; subject\/actor eligibility failure<\/td>\n<\/tr>\n
14<\/strong><\/td>\nUnauthorized output audience requested<\/td>\nSTS target policy<\/td>\nReject; disallowed exchange edge<\/td>\n<\/tr>\n
15<\/strong><\/td>\nScopes exceed approved grant<\/td>\nSTS scope policy<\/td>\nReject or explicitly downscope; record granted set<\/td>\n<\/tr>\n
16<\/strong><\/td>\nMissing actor on delegated-only API<\/td>\nAPI delegated-profile policy<\/td>\nReject; required-actor failure<\/td>\n<\/tr>\n
17<\/strong><\/td>\nMalformed nested actor structure<\/td>\nSTS\/API schema validation<\/td>\nReject; malformed identity context<\/td>\n<\/tr>\n
18<\/strong><\/td>\nNested actor has privileged identity<\/td>\nAPI authorization engine<\/td>\nNo privilege union; deny operation not allowed by top-level context<\/td>\n<\/tr>\n
19<\/strong><\/td>\nValid token mutates wrong case<\/td>\nAPI object authorization<\/td>\nReject; resource mismatch<\/td>\n<\/tr>\n
20<\/strong><\/td>\nValid token changes forbidden field<\/td>\nAPI mutation authorization<\/td>\nReject; actual-body constraint failure<\/td>\n<\/tr>\n
21<\/strong><\/td>\nApproval expired before exchange<\/td>\nSTS approval service<\/td>\nReject; stale grant<\/td>\n<\/tr>\n
22<\/strong><\/td>\nApproval revoked after token issuance<\/td>\nAPI current-grant control if configured<\/td>\nReject within measured distribution\/cache window<\/td>\n<\/tr>\n
23<\/strong><\/td>\nOne-time authorization reused<\/td>\nAPI transactional grant control<\/td>\nNo second mutation; atomic use evidence<\/td>\n<\/tr>\n
24<\/strong><\/td>\nStolen bearer token presented elsewhere<\/td>\nResource authentication<\/td>\nMay succeed absent sender constraint; document residual risk<\/td>\n<\/tr>\n
25<\/strong><\/td>\nWrong certificate for bound token<\/td>\nmTLS\/token-binding verifier<\/td>\nReject; certificate-thumbprint mismatch<\/td>\n<\/tr>\n
26<\/strong><\/td>\nWrong DPoP key or token hash<\/td>\nDPoP-capable resource<\/td>\nReject; proof\/token binding failure<\/td>\n<\/tr>\n
27<\/strong><\/td>\nReplayed DPoP proof<\/td>\nDPoP replay\/freshness verifier<\/td>\nReject per deployed replay policy; proof evidence<\/td>\n<\/tr>\n
28<\/strong><\/td>\nUnknown kid during discovery outage<\/td>\nSTS\/API key validation<\/td>\nReject unknown key; bounded refresh attempts<\/td>\n<\/tr>\n
29<\/strong><\/td>\nPlanned key rollover with old\/new tokens<\/td>\nSTS\/API verification caches<\/td>\nValid intended tokens pass during planned overlap<\/td>\n<\/tr>\n
30<\/strong><\/td>\nDisabled actor uses cached valid JWT<\/td>\nResource deny\/revocation controls<\/td>\nMeasure rejection latency; no unsupported instant-revocation claim<\/td>\n<\/tr>\n
31<\/strong><\/td>\nWorkload does not match registration selectors<\/td>\nSPIRE workload issuance<\/td>\nNo XYZ credential; attestation\/issuance evidence<\/td>\n<\/tr>\n
32<\/strong><\/td>\nUnrelated pod chooses XYZ service account<\/td>\nAdmission\/RBAC plus SPIRE policy<\/td>\nBlocked deployment or deny issuance; otherwise record privilege gap<\/td>\n<\/tr>\n
33<\/strong><\/td>\nUnauthorized node attempts enrollment<\/td>\nSPIRE node attestation<\/td>\nNo accepted eligible agent identity<\/td>\n<\/tr>\n
34<\/strong><\/td>\nQueued job runs after delegation revoked<\/td>\nWorker authorization boundary<\/td>\nReject execution; log job and approval IDs<\/td>\n<\/tr>\n
35<\/strong><\/td>\nTenant\/resource identifier substitution<\/td>\nSTS and resource tenant policy<\/td>\nReject cross-tenant access<\/td>\n<\/tr>\n
36<\/strong><\/td>\nPolicy\/STS outage triggers retry fallback<\/td>\nApplication\/worker failure path<\/td>\nNo anonymous or broader-authority fallback<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Acceptance criteria<\/h2>\n
    \n
  • Every failure occurs at a documented boundary and emits useful non-secret audit evidence.<\/li>\n
  • No test silently changes a delegated request into impersonation or anonymous access.<\/li>\n
  • No requested audience or scope becomes trusted merely because it was requested.<\/li>\n
  • Resource-level constraints are checked against the actual operation and canonical object.<\/li>\n
  • Revocation and outage tests report measured windows, not assumed guarantees.<\/li>\n
  • Concurrent one-time execution tests demonstrate atomic behavior.<\/li>\n
  • Known valid controls still pass after policy tightening and planned key rotation.<\/li>\n<\/ul>\n

    Adversarial execution and evidence<\/h2>\n

    Repeat tests with concurrency, stale caches, alternate replicas, and retrying workers. Exercise non-happy-path serialization and identifier normalization. Confirm that every API instance uses the same intended policy version. Capture both denial and business-state evidence: a rejected response is insufficient if a mutation occurred before the rejection.<\/p>\n

    Takeaway: a useful test report says where abuse was blocked, why, what residual exposure remains, and how quickly changes reach every enforcement point.<\/p>\n","protected":false},"excerpt":{"rendered":"

    A security architecture should be judged by rejection behavior, not only by a successful demonstration. Each test below states a precondition, an enforcement point, and evidence to collect. The exact HTTP status or OAuth error depends on the failing stage and implementation; do not require a universal error code where the standards or product do …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2243],"tags":[2246,2244,2216,2245],"class_list":["post-12655","post","type-post","status-publish","format-standard","hentry","category-spiffe","tag-agent-identity","tag-spiffe","tag-spire","tag-workload-identity"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12655"}],"version-history":[{"count":2,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12655\/revisions"}],"predecessor-version":[{"id":12659,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12655\/revisions\/12659"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}