Identity Management is the foundation upon which authentication and authorization are built. This category examines the processes by which user accounts are created, roles are assigned, and identities are managed throughout their lifecycle. Testing in this area reveals whether an attacker can create unauthorized accounts, enumerate valid usernames, escalate privileges through role manipulation, or exploit weak identity policies. Understanding identity management vulnerabilities is critical for both offensive security testing and secure application design. These tests are highly relevant for certifications like CISSP, which emphasizes Identity and Access Management as a core security domain.
OWASP Top 10 Mapping
This testing category relates to the following OWASP Top 10 2021 categories:
Quick Reference
| Test ID | Name | CWEs | Difficulty |
|---|---|---|---|
| WSTG-IDNT-01 | Role Definitions Testing | CWE-284, CWE-269 | Intermediate |
| WSTG-IDNT-02 | User Registration Testing | CWE-284 | Intermediate |
| WSTG-IDNT-03 | Account Provisioning Testing | CWE-284, CWE-269 | Intermediate |
| WSTG-IDNT-04 | Account Enumeration | CWE-200, CWE-204 | Intermediate |
| WSTG-IDNT-05 | Username Policy Testing | CWE-284 | Intermediate |
Detailed Test Cases
WSTG-IDNT-01: Role Definitions Testing
IntermediateThis test evaluates how the application defines and enforces user roles. It examines whether roles follow the principle of least privilege, whether role definitions are clear, and whether there are ways to manipulate role assignments to gain elevated access.
What to Check
- Identify all user roles and their associated permissions
- Verify that roles follow the principle of least privilege
- Test whether role assignments can be manipulated through client-side parameters
- Check for overlapping permissions between roles that could create confusion
- Confirm that administrative roles are properly separated from regular user roles
WSTG-IDNT-02: User Registration Testing
IntermediateThis test examines the user registration process for weaknesses including lack of CAPTCHA, acceptance of disposable email addresses, weak identity verification, and the ability to register with duplicate or spoofed identities.
What to Check
- Test if registration can be automated without CAPTCHA or rate limiting
- Check if disposable email addresses are accepted for registration
- Verify that duplicate accounts with the same email or username are rejected
- Test whether registration parameters can be manipulated to set elevated roles
- Confirm email verification is required before account activation
WSTG-IDNT-03: Account Provisioning Testing
IntermediateThis test reviews how accounts are provisioned, modified, and deprovisioned within the application. It checks whether administrative account management follows secure processes and whether former users retain access after deprovisioning.
What to Check
- Verify that account creation follows an approval workflow for privileged roles
- Test whether deprovisioned accounts are fully disabled and cannot authenticate
- Check if account modification actions are logged and auditable
- Confirm that temporary or test accounts have expiration dates
- Test whether bulk account provisioning properly validates each account
WSTG-IDNT-04: Account Enumeration
IntermediateThis test determines whether an attacker can enumerate valid usernames or email addresses through the application's login, registration, or password recovery functions. Different error messages, response times, or HTTP status codes for valid versus invalid accounts reveal this information.
What to Check
- Compare error messages for valid versus invalid usernames on the login page
- Check registration forms for different responses when an existing email is used
- Test password reset functionality for account enumeration through error messages
- Measure response time differences between valid and invalid username attempts
- Look for differences in HTTP response codes or headers between valid and invalid attempts
WSTG-IDNT-05: Username Policy Testing
IntermediateThis test evaluates whether the application enforces a strong username policy, including minimum length, allowed characters, and uniqueness requirements. Weak username policies can make accounts easier to guess and harder to manage securely.
What to Check
- Test if the application allows very short or single-character usernames
- Check whether common reserved names (admin, root, test) can be registered by regular users
- Verify that username format requirements are enforced consistently
- Test for case sensitivity in username handling (Admin vs admin)
- Check if usernames can contain special characters that might cause injection issues
Relevant Certifications
The following certifications cover identity management concepts:
Frequently Asked Questions
What is identity management in web application security?
Identity management in web security refers to how applications handle user accounts throughout their lifecycle: registration, provisioning, role assignment, and deactivation. Poor identity management can allow attackers to create fake accounts, enumerate valid users, or gain elevated privileges through flawed role assignment processes.
What is account enumeration and why is it a security risk?
Account enumeration occurs when an application reveals whether a specific username or email exists in the system, typically through different error messages on login, registration, or password reset pages. This is risky because attackers can compile a list of valid accounts to target with brute-force attacks, credential stuffing, or social engineering campaigns.
How do identity management vulnerabilities differ from authentication vulnerabilities?
Identity management focuses on how accounts and roles are created and maintained, while authentication focuses on how users prove their identity. For example, a weak registration process that allows duplicate accounts is an identity management issue, while a weak password policy is an authentication issue. Both are critical, but they target different parts of the access control chain.
CyberFolio
Mastering web security testing? Showcase your skills.
Build a free, shareable cybersecurity portfolio that highlights your certifications, projects, and skills.
Build Your Portfolio →