Company XYZ has decided to make use of a cloud-based service that requires mutual, certificate- based authentication with its users. The company uses SSL-inspecting IDS at its network boundary and…

OATH provides strong authentication but does not inherently prevent an SSL-inspecting IDS from performing a Man-in-the-Middle attack on the mutual certificate-based communication itself, which would allow it to decrypt and inspect the session keys.

Active Directory Federation allows users to authenticate against their company's internal identity provider, ensuring their primary credentials (passwords or private keys) never traverse the external network to the cloud service. Instead, a security token is issued by the internal IdP and presented to the cloud service, thereby preventing the SSL-inspecting IDS from capturing the actual credentials or keys used in the initial authentication.

While smartcards provide strong, certificate-based authentication, the direct communication between the user and the cloud service would still pass through the SSL-inspecting IDS, allowing it to decrypt and re-encrypt the traffic, thus exposing the certificate exchange and session key negotiation.

A generic 'third-party, SAML-based authentication service' for attestation might still require user credentials to be sent across the network boundary to that third party, where the SSL-inspecting IDS could intercept them, failing to guarantee that primary authentication occurs internally within the company.