CAS-002 · Question #114
The <nameID> element in SAML can be provided in which of the following predefined formats? (Select TWO).
The correct answer is A. X.509 subject name D. Kerberos principal name. The SAML specification defines X.509 subject name and Kerberos principal name as two of its predefined nameID formats used to identify principals in assertions.
Question
The <nameID> element in SAML can be provided in which of the following predefined formats? (Select TWO).
Options
- AX.509 subject name
- BPTR DNS record
- CEV certificate OID extension
- DKerberos principal name
- EWWN record name
How the community answered
(24 responses)- A92% (22)
- C4% (1)
- E4% (1)
Why each option
The SAML specification defines X.509 subject name and Kerberos principal name as two of its predefined nameID formats used to identify principals in assertions.
The SAML 1.1 specification defines urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName as a valid nameID format, allowing an X.509 certificate subject distinguished name to identify a principal in an assertion.
PTR records are reverse-lookup entries in the DNS infrastructure used to map IP addresses to hostnames and are not defined as a nameID format in any version of the SAML specification.
EV certificate OID extensions are X.509 certificate policy fields that indicate extended validation status and are not defined as a nameID format in the SAML specification.
The SAML 2.0 specification defines urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos as a valid nameID format, allowing a Kerberos principal name to identify a subject across federated identity systems.
WWN (World Wide Name) records are Fibre Channel storage network device identifiers and have no relationship to SAML identity assertion formats.
Concept tested: SAML nameID predefined format types
Source: https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
Topics
Community Discussion
No community discussion yet for this question.