When using SAML, where does user authentication occur?

Question

Options

• ASplunk generates a SAML assertion that authenticates the user.
• BThe Service Provider (SP) decodes the SAML request and authenticates the user.
• CThe Identity Provider (IDP) decodes the SAML request and authenticates the user.
• DThe Service Provider (SP) generates a SAML assertion that authenticates the user.

• A
  5% (1)
• C
  89% (17)
• D
  5% (1)

Explanation

In SAML (Security Assertion Markup Language), authentication always occurs at the Identity Provider (IDP) - the IDP is the trusted authority that verifies the user's credentials and then generates a signed SAML assertion confirming that authentication. Option A is wrong because Splunk (acting as a Service Provider) never generates assertions - it only consumes them. Option B is wrong because the SP decodes the assertion, not the request, and it doesn't authenticate the user; it delegates that responsibility entirely to the IDP. Option D is wrong for the same reason: SPs receive and validate assertions, they never generate them.

Memory tip: Think of the IDP as the "bouncer" who checks your ID and hands you a wristband (the SAML assertion), while the SP is the "club" that only checks for the wristband - it never checks your ID itself.

No community discussion yet for this question.