CIAM CIAM Federation and Single Sign-On 2 — Questions and Answers
Question 1: In SAML, what is an 'assertion'?
- A firewall rule granting access
- An XML statement conveying information about a subject's identity and attributes (Correct answer)
- A password hash used for authentication
- A public key certificate issued by a CA
Correct answer: An XML statement conveying information about a subject's identity and attributes
A SAML assertion is an XML-based statement issued by an Identity Provider that conveys identity, attribute, and authorization decision information about a subject.
Question 2: What standard is OpenID Connect built on top of?
- SAML 2.0
- OAuth 2.0 (Correct answer)
- WS-Federation
- Kerberos
Correct answer: OAuth 2.0
OpenID Connect is an identity layer built directly on top of OAuth 2.0, adding authentication and identity claims to OAuth's authorization framework.
Question 3: Which token format is most commonly used in modern OAuth 2.0 and OpenID Connect implementations?
- SAML assertion
- JSON Web Token (JWT) (Correct answer)
- Kerberos ticket
- X.509 certificate
Correct answer: JSON Web Token (JWT)
JSON Web Tokens (JWTs) are widely used as access tokens and ID tokens in OAuth 2.0 and OpenID Connect due to their compact, self-contained structure.
Question 4: What is 'SP-initiated SSO'?
- SSO triggered by a security policy engine
- SSO where the user first accesses the Service Provider, which redirects to the IdP (Correct answer)
- SSO using only service principal names
- SSO initiated by a superuser administrator
Correct answer: SSO where the user first accesses the Service Provider, which redirects to the IdP
In SP-initiated SSO, the user first attempts to access a resource at the Service Provider, which then redirects them to the Identity Provider for authentication.
Question 5: What is the purpose of the audience restriction in a SAML assertion?
- To limit the number of concurrent users
- To specify which Service Provider is authorized to consume the assertion (Correct answer)
- To restrict authentication to certain geographic regions
- To limit the token's validity period
Correct answer: To specify which Service Provider is authorized to consume the assertion
The audience restriction in a SAML assertion specifies which Service Provider(s) may use it, preventing a valid assertion from being replayed at an unintended service.
Question 6: What is 'account linking' in federated identity?
- Connecting bank accounts to a user profile
- Associating a user's local account with an external identity provider account to enable SSO (Correct answer)
- Linking multiple user permissions into a single role
- Connecting multiple authentication devices to one account
Correct answer: Associating a user's local account with an external identity provider account to enable SSO
Account linking associates a user's local service account with their external Identity Provider account, enabling SSO without requiring identical usernames across systems.
CIAM CIAM Federation and Single Sign-On 2
In SAML, what is an 'assertion'?