CAS-001 · Question #503
A bank provides single sign on services between its internally hosted applications and externally hosted CRM. The following sequence of events occurs: 1.The banker accesses the CRM system, a…
The correct answer is A. Service provider initiated SAML 2.0. The described flow is service provider initiated SAML 2.0 because the CRM (service provider) triggers the authentication redirect, and the features - signed and encrypted tokens plus automated just-in-time provisioning - are characteristic of SAML 2.0.
Question
A bank provides single sign on services between its internally hosted applications and externally hosted CRM. The following sequence of events occurs:
1.The banker accesses the CRM system, a redirect is performed back to the organization's internal systems. 2.A lookup is performed of the identity and a token is generated, signed and encrypted. 3.A redirect is performed back to the CRM system with the token. 4.The CRM system validates the integrity of the payload, extracts the identity and performs a lookup. 5.If the banker is not in the system and automated provisioning request occurs. 6.The banker is authenticated and authorized and can access the system. This is an example of which of the following?
Options
- AService provider initiated SAML 2.0
- BIdentity provider initiated SAML 1.0
- COpenID federated single sign on
- DService provider initiated SAML 1.1
How the community answered
(20 responses)- A70% (14)
- B10% (2)
- C5% (1)
- D15% (3)
Why each option
The described flow is service provider initiated SAML 2.0 because the CRM (service provider) triggers the authentication redirect, and the features - signed and encrypted tokens plus automated just-in-time provisioning - are characteristic of SAML 2.0.
The flow is service provider initiated because the user first accesses the CRM (the service provider), which then redirects to the internal identity provider for authentication. SAML 2.0 is indicated by the combination of token signing and encryption, the structured redirect-based binding, and the automated provisioning (just-in-time provisioning) in step 5, which is a SAML 2.0 capability not present in earlier versions.
Identity provider initiated flows begin at the IdP before the user accesses the SP; here the user accesses the CRM first. Additionally, SAML 1.0 lacked robust support for SP-initiated flows and automated provisioning.
OpenID Connect uses a different token format (JWT via OAuth 2.0 flows) and does not describe the redirect-with-signed-encrypted-assertion pattern or the automated provisioning step shown here.
SAML 1.1 did not natively support SP-initiated SSO via browser redirect binding nor the automated just-in-time provisioning described in step 5.
Concept tested: Service provider initiated SAML 2.0 SSO flow
Source: https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf
Topics
Community Discussion
No community discussion yet for this question.