Analysis and detection of golden SAML attacks