CAS-003 · Question #567
A company is moving all of its web applications to an SSO configuration using SAML. Some employees report that when signing in to an application, they get an error message on the login screen after…
The correct answer is A. The employees are using an old link that does not use the new SAML authentication. The critical clue is the contrast: employees fail on one application after entering credentials, but successfully authenticate on other SSO-converted apps without being prompted at all (SSO is working). This strongly suggests the failing application is still being accessed via…
Question
A company is moving all of its web applications to an SSO configuration using SAML. Some employees report that when signing in to an application, they get an error message on the login screen after entering their username and password, and are denied access. When they access another system that has been converted to the new SSO authentication model, they are able to authenticate successfully without being prompted for login. Which of the following is MOST likely the issue?
Options
- AThe employees are using an old link that does not use the new SAML authentication.
- BThe XACML for the problematic application is not in the proper format or may be using an
- CThe web services methods and properties are missing the required WSDL to complete the
- DA threat actor is implementing an MITM attack to harvest credentials.
How the community answered
(25 responses)- A72% (18)
- B8% (2)
- C16% (4)
- D4% (1)
Explanation
The critical clue is the contrast: employees fail on one application after entering credentials, but successfully authenticate on other SSO-converted apps without being prompted at all (SSO is working). This strongly suggests the failing application is still being accessed via an old direct URL that bypasses the SAML identity provider and points to the application's native login page - which may no longer accept local credentials now that SSO is configured. Option B (XACML) is an authorization policy language, not relevant to login errors. Option C (WSDL) describes web service interfaces, not authentication flows. Option D (MITM) is implausible because other SSO applications work correctly from the same clients.
Topics
Community Discussion
No community discussion yet for this question.