CAS-001 · Question #186
Company XYZ provides residential television cable service across a large region. The company's board of directors is in the process of approving a deal with the following three companies: - A…
The correct answer is D. Company XYZ needs to install the IdP, while the partner companies need to install the SP portion. Federated identity management using SAML requires Company XYZ to act as the Identity Provider (IdP), holding customer credentials, while partner companies act as Service Providers (SPs) that consume assertions.
Question
Company XYZ provides residential television cable service across a large region. The company's board of directors is in the process of approving a deal with the following three companies:
- A National landline telephone provider
- A Regional wireless telephone provider
- An international Internet service provider
The board of directors at Company XYZ wants to keep the companies and billing separated. While the Chief Information Officer (CIO) at Company XYZ is concerned about the confidentiality of Company XYZ's customer data and wants to share only minimal information about its customers for the purpose of accounting, billing, and customer authentication. The proposed solution must use open standards and must make it simple and seamless for Company XYZ's customers to receive all four services. Which of the following solutions is BEST suited for this scenario?
Options
- AAll four companies must implement a TACACS+ web based single sign-on solution with associated
- BCompany XYZ must implement VPN and strict access control to allow the other three companies
- CCompany XYZ needs to install the SP, while the partner companies need to install the WAYF portion
- DCompany XYZ needs to install the IdP, while the partner companies need to install the SP portion
How the community answered
(24 responses)- A25% (6)
- B4% (1)
- C8% (2)
- D63% (15)
Why each option
Federated identity management using SAML requires Company XYZ to act as the Identity Provider (IdP), holding customer credentials, while partner companies act as Service Providers (SPs) that consume assertions.
TACACS+ is a proprietary Cisco AAA protocol, not an open standard, and is not designed for cross-organizational web-based single sign-on between multiple independent companies.
VPN with strict access control requires network-level integration between all four companies and does not provide a seamless single sign-on experience for end customers.
WAYF (Where Are You From) is a discovery service component used in Shibboleth federations, not the SP component itself; having Company XYZ install only an SP while holding all customer data inverts the correct IdP-SP relationship.
In a SAML federation, the Identity Provider is the authoritative source for user authentication and issues signed assertions, while Service Providers rely on those assertions to grant access. Company XYZ already owns the customer data and authentication records, making it the natural IdP, while the three partner companies install SP components that accept the IdP's assertions to grant service access. This open-standards approach minimizes data sharing - only necessary identity attributes are passed in assertions - satisfying the CIO's confidentiality requirement.
Concept tested: SAML federated identity IdP and SP roles
Source: https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol
Topics
Community Discussion
No community discussion yet for this question.