Penetration test of a cross-system single sign-on system