Where Are You From? (WAYF)

What a WAYF page does

A Where Are You From? page is an entry point in federated sign-in that asks the user to pick an organisation or identity provider before authentication begins. It sits at a sensitive trust boundary, because the chooser itself influences where the user is redirected and which trust relationship will be used for the login flow.

In practice, WAYF is less about user convenience than about routing the user to the correct federation path. That means the page must be designed so the choice is understandable, limited to legitimate options, and resistant to manipulation by lookalike branding or hostile redirection.

Why WAYF pages matter in federated access

The value of WAYF is that it reduces confusion in multi-organisation environments and helps users start the right authentication flow. The risk is that a poorly controlled chooser can become a phishing surface: an attacker can mimic an identity-provider option, steer a user to a fraudulent sign-in page, or exploit weak destination handling to misroute the session.

Because the chooser influences the first step of authentication, it also affects whether the user reaches the intended security controls. A weak WAYF implementation can turn a federation convenience feature into an origin-trust problem, especially when organisations rely on branded portals, deep links, or partner directories.

Common failure modes

The main failure modes are destination manipulation, deceptive presentation, and overbroad choice sets. If the page accepts user-controlled destinations without strict allowlisting, the chooser can be abused as a redirector. If it exposes too many identity providers or uses inconsistent naming, users may select the wrong organisation and complete sign-in against an unintended trust domain.

Another failure mode is information leakage. Even when the page is not directly vulnerable to takeover, the set of available identity providers can reveal corporate relationships, tenant structure, or which federation partners are active. That metadata may be useful to attackers building phishing lures or targeting specific organisations.

How organisations should think about control and assurance

WAYF should be treated as a security-sensitive front door, not a cosmetic landing page. Organisations should keep the selector narrowly scoped, validate every destination against an approved federation list, and ensure the user can easily confirm they are proceeding to the right identity provider before sign-in continues. Federated identity guidance such as NIST SP 800-63 Digital Identity Guidelines is useful when designing the broader sign-in experience, while EU NIS2 Directive and NIST SP 800-53 Rev 5 Security and Privacy Controls reinforce the need for controlled access paths, authentication governance, and resilient identity handling.

For organisations using federated identity at scale, the operational question is whether the chooser is serving a trusted routing function or becoming a generic lookup page. The safer pattern is to minimise dynamic behaviour and keep the page aligned with explicit, pre-approved identity relationships.

Risk and Threat Considerations

WAYF pages concentrate trust in a small interaction that users often treat as routine, which makes them attractive for phishing, spoofing, and misdirection. If the chooser leaks identity-provider choices or accepts unsafe destinations, it can reveal organisation structure and create a path into fraudulent authentication flows.

Failure mechanism: An attacker abuses the selection step by impersonating a legitimate provider, manipulating the redirect target, or exploiting weak validation to send the user to an unintended login endpoint.

Impact: Users can disclose credentials to a fraudulent IdP, complete sign-in against the wrong tenant, or expose federation relationships that help attackers tailor later social engineering.

Practitioner Guidance

Why practitioners should care: Treat WAYF as part of the authentication boundary, not as a simple navigation page. The user’s first click can determine which trust domain, branding surface, and login policy they encounter, so the chooser should be designed and reviewed with the same care as the sign-in flow itself.

What to watch for: Look for open redirect behaviour, unvalidated federation targets, confusing identity-provider naming, and any page design that lets a user make a high-trust choice without enough context to verify the destination. Those are the conditions that most often turn a convenience feature into a phishing enabler.

Related resources from NHI Mgmt Group

• How do you know if agent identity controls are actually working?
• How do you know if Oracle access governance is actually working?
• How do you know if Oracle SoD evidence is actually working?
• How do you know if identity maturity is actually reducing NHI risk?