nerdexam
CompTIA

CAS-002 · Question #247

A bank provides single sign on services between its internally hosted applications and externally hosted CRM. The following sequence of events occurs: 1. The banker accesses the CRM system, a…

The correct answer is A. Service provider initiated SAML 2.0. The described flow is service provider initiated SAML 2.0 because the authentication sequence originates at the CRM (service provider) and uses encrypted assertions and automated just-in-time provisioning, which are SAML 2.0 features.

Technical Integration of Enterprise Components

Question

A bank provides single sign on services between its internally hosted applications and externally hosted CRM. The following sequence of events occurs: 1. The banker accesses the CRM system, a redirect is performed back to the organization's internal systems. 2. A lookup is performed of the identity and a token is generated, signed and encrypted. 3. A redirect is performed back to the CRM system with the token. 4. The CRM system validates the integrity of the payload, extracts the identity and performs a lookup. 5. If the banker is not in the system and automated provisioning request occurs. 6. The banker is authenticated and authorized and can access the system. This is an example of which of the following?

Options

  • AService provider initiated SAML 2.0
  • BIdentity provider initiated SAML 1.0
  • COpenID federated single sign on
  • DService provider initiated SAML 1.1

How the community answered

(19 responses)
  • A
    84% (16)
  • C
    5% (1)
  • D
    11% (2)

Why each option

The described flow is service provider initiated SAML 2.0 because the authentication sequence originates at the CRM (service provider) and uses encrypted assertions and automated just-in-time provisioning, which are SAML 2.0 features.

AService provider initiated SAML 2.0Correct

The flow is service provider initiated because the banker first accesses the CRM - the service provider - which then redirects to the internal identity provider for authentication, which is the defining characteristic of SP-initiated SAML. SAML 2.0 is confirmed by the use of signed and encrypted tokens (SAML 2.0 added native assertion encryption) and by the automated just-in-time provisioning step in event 5, a capability introduced in SAML 2.0 that is absent from earlier versions.

BIdentity provider initiated SAML 1.0

Identity provider initiated SAML means the session originates at the IdP and pushes the user to the service provider - in this scenario the flow starts at the CRM (SP), not the IdP - and SAML 1.0 does not support assertion encryption or automated provisioning.

COpenID federated single sign on

OpenID Connect uses a fundamentally different protocol flow based on OAuth 2.0 with authorization codes and JWT tokens, not the XML-based SAML assertion redirect flow with signed and encrypted payloads described in this sequence.

DService provider initiated SAML 1.1

SAML 1.1 does not natively support encrypted assertions or just-in-time automated provisioning, and the flow described is SP-initiated rather than IdP-initiated - both of these characteristics align specifically with SAML 2.0.

Concept tested: Service provider initiated SAML 2.0 SSO federation flow

Source: https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf

Topics

#SAML 2.0#SSO#federated identity#service provider

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice