# SP-032 Modern Authentication

Status: active. Release 26.02. Modified 2026-02-07. Licence: CC BY-SA 4.0.

Scope: Enterprise authentication architecture pattern covering directory services, federation, and token-based authentication using OIDC, OAuth 2.0, and JWT. Provides a worked example of end-to-end authentication flow from user login through token issuance, validation, and session management.
Use when: This pattern applies to any organisation that authenticates users to applications -- effectively universal. It is particularly relevant when: multiple applications maintain separate user databases and password stores (authentication sprawl), the organisation is adopting cloud services and needs SSO across on-premises and cloud, regulatory requirements mandate strong authentication and comprehensive audit trails, the...
Not when: Organisations with a single monolithic application and no integration requirements may find the overhead of deploying an IdP and implementing OIDC disproportionate -- though even here, modern authentication provides future-proofing.

## Controls (33, NIST SP 800-53 ids)
- Critical (12): AC-02, AC-03, AC-12, AU-02, IA-02, IA-04, IA-05, IA-08, SC-08, SC-12, SC-13, SC-23
- Important (14): AC-06, AC-07, AC-17, AU-03, AU-06, AU-12, CA-07, CM-03, IA-09, IA-11, IA-12, SA-08, SA-09, SI-04
- Standard (7): AC-01, AC-08, AC-21, AT-02, CM-06, IA-06, PL-02

## What each critical control mitigates (12)
- AC-02 Account Management: none of the threats below
- AC-03 Access Enforcement: T-MA-006, T-MA-008, T-MA-009
- AC-12 Session Termination: T-MA-003, T-MA-004, T-MA-012
- AU-02 Event Logging: T-MA-010, T-MA-011
- IA-02 Identification and Authentication (Organizational Users): T-MA-001, T-MA-002
- IA-04 Identifier Management: none of the threats below
- IA-05 Authenticator Management: T-MA-001, T-MA-002, T-MA-010
- IA-08 Identification and Authentication (Non-organizational Users): T-MA-009
- SC-08 Transmission Confidentiality and Integrity: T-MA-003, T-MA-004, T-MA-006
- SC-12 Cryptographic Key Establishment and Management: T-MA-005, T-MA-007, T-MA-009, T-MA-011
- SC-13 Cryptographic Protection: T-MA-005, T-MA-008, T-MA-011
- SC-23 Session Authenticity: T-MA-003, T-MA-004, T-MA-006, T-MA-012

## Threats and the controls that mitigate them (12)
- T-MA-001 Credential stuffing using breached password databases: IA-05, AC-07, AU-06, IA-02
- T-MA-002 Phishing for passwords and MFA codes: IA-02, IA-05, AT-02, IA-12
- T-MA-003 OAuth token theft via XSS or insecure storage: SC-23, AC-12, SC-08, SA-08
- T-MA-004 Session hijacking through stolen session cookies: SC-23, SC-08, AC-12, SI-04
- T-MA-005 JWT signature bypass or algorithm confusion attack: SC-13, SC-12, SA-08, AU-06
- T-MA-006 Authorisation code interception (CSRF/replay): AC-03, SC-23, SC-08, SA-08
- T-MA-007 Identity provider compromise or misconfiguration: CA-07, CM-03, SC-12, AU-06
- T-MA-008 Privilege escalation through token scope manipulation: AC-06, AC-03, SC-13, AU-06
- T-MA-009 Federation trust exploitation by compromised partner IdP: IA-08, SA-09, SC-12, AC-03
- T-MA-010 Account takeover via password reset flow abuse: IA-05, IA-12, AU-02, AC-07
- T-MA-011 Service-to-service credential theft (client secrets): IA-09, SC-12, SC-13, AU-02
- T-MA-012 Refresh token abuse for persistent unauthorised access: AC-12, SC-23, AU-06, IR-04

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-032/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-032/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 27 KB: /api/v1/patterns/SP-032
- Page for people: /patterns/sp-032/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-010 Identity Management Pattern; SP-029 Zero Trust Architecture; SP-030 API Security; SP-033 Passkey Authentication

This card, the API and the page are generated from one file. Checking one against another adds no evidence.