Golden SAML Forgery

Golden SAML is a post-compromise technique in which an operator with the AD FS token-signing private key and required federation configuration creates a new SAML assertion or response for an identity and claims. A relying party that trusts the signing certificate and accepts those claims may establish the impersonated session without the user's password; it may also accept a forged MFA claim if its policy trusts MFA asserted by the identity provider. A password reset alone does not invalidate a still-trusted signing key. Whether a token is accepted depends on the relying party's trust, audience, recipient, claims, validity, and independent authentication policy.