VeridiumID 3.9 strengthens the protection of active Single Sign-On sessions across SAML and OIDC integrations.
Session security is now applied throughout the SSO lifecycle rather than only during the initial authentication. When an existing Identity Provider session is reused to access another application, or when an OIDC access or refresh token is requested, VeridiumID can reassess the session using the latest identity status and available request context.
Continuous Session Validation
Active SSO sessions are validated before they are reused. During this validation, VeridiumID verifies that the associated identity remains active and evaluates contextual information from the current request.
If the identity has been blocked or the session is no longer considered valid, the existing session can be invalidated, preventing it from being reused to access additional applications.
The enhanced validation applies to:
-
SAML Single Sign-On sessions
-
OIDC Single Sign-On sessions
-
OIDC access-token requests
-
OIDC refresh-token requests
Risk-Aware Session Evaluation
VeridiumID can submit the context collected during an SSO or OIDC token request to Intelligent Login Protection for risk evaluation.
The resulting risk score is associated with the Identity Provider session and can be used to determine the appropriate security response. Depending on the configured protection policy, suspicious activity can require the user to authenticate again or can cause the existing Identity Provider session to be revoked.
This allows organizations to react to changes in user behavior or request context even after the initial authentication has been completed.
Consistent Protection Across SSO Flows
Session-validation logic has been centralized to provide consistent security decisions across supported SAML and OIDC flows.
This architecture also simplifies the management of session-protection rules. Changes to risk conditions and revocation policies can be applied centrally, reducing integration-specific dependencies and providing a foundation for extending the same protection model to additional Identity Provider integrations.
Improved Session Visibility
Additional session context is available for auditing and investigation, including:
-
The Intelligent Login Protection risk score associated with the session
-
Whether authentication was newly performed or an existing session was reused
-
More detailed session and authentication timestamps
These enhancements provide administrators with clearer insight into how SSO sessions are evaluated and how VeridiumID responds to changes in identity status or contextual risk.
New dashboards have been added in Kibana to represent the SSO experience:
