Drag and Drop Question Match the terms related to Workspace ONE Access SAML 2.0 authentication on the left with their corresponding definitions on the right. Answer:

Question

Exhibit

Answer Area

Explanation

SAML 2.0 Matching Question - Explained

Note: The question shows terms matched to numbered definitions, but the definitions themselves aren't included in your paste. The explanation below is based on the standard definitions these terms are always matched to in Workspace ONE / SAML 2.0 exams.

The Terms and Their Definitions

1. Identity Provider (IdP)

The entity that authenticates the user and issues security assertions. In Workspace ONE Access, the Access tenant itself acts as the IdP - it verifies who you are and vouches for that identity to other services.

Common misconception: Beginners confuse IdP with the app being accessed. The IdP authenticates; it does not serve the resource.

2. Assertion

An XML-formatted security statement issued by the IdP to the Service Provider. It contains claims about the user: who they are (authentication assertion), what they're allowed to do (authorization assertion), and their attributes (e.g., email, groups).

Common misconception: Assertions are not tokens in the OAuth/JWT sense - they are structured XML documents signed by the IdP.

3. SAML 2.0

The open standard protocol (Security Assertion Markup Language, version 2.0) that defines the format and rules for exchanging authentication and authorization data between an IdP and SP using XML over HTTP.

Common misconception: SAML 2.0 is often confused with OAuth or OIDC. SAML is XML-based and enterprise-focused; OAuth/OIDC are JSON/REST-based and more modern.

4. Service Provider (SP)

The application or resource the user wants to access (e.g., Salesforce, Office 365). The SP trusts the IdP's assertion and grants access based on it - it does not perform authentication itself.

Common misconception: The SP does not verify the user's password - it delegates that entirely to the IdP.

5. Single Sign-On (SSO)

The capability (enabled by SAML 2.0) that allows a user to authenticate once with the IdP and then access multiple Service Providers without re-entering credentials.

Common misconception: SSO is the outcome of SAML working correctly - it is not a protocol itself. SAML is the mechanism; SSO is the user experience result.

Why This Ordering Makes Sense

The arrangement follows the logical flow of a SAML authentication event:

This order reflects: who authenticates → what they produce → how it's transmitted → who receives it → what the user gains.

No community discussion yet for this question.