Examkin

Question

Difficulty: MediumIdentity Federation and Directory Services

A media production company uses PingFederate as its central Identity Provider (IdP). The company is setting up a multi-account structure in AWS Organizations and wants to enable its remote editors to log in to specific AWS accounts using their existing corporate credentials. The solution must support central permissions management and automatically synchronize user accounts and group memberships from PingFederate to AWS without manual user creation.

Which combination of actions should a solutions architect perform to meet these requirements? (Select two.)

  1. Configure SAML 2.0 federation between PingFederate and AWS IAM Identity Center by exchanging metadata.Answer
  2. Enable System for Cross-domain Identity Management (SCIM) provisioning in AWS IAM Identity Center, and configure the SCIM endpoint and access token in PingFederate.Answer
  3. C
    Create individual IAM users in each AWS member account and configure cross-account IAM role assumptions for federated access.
  4. D
    Provision an AWS Directory Service AD Connector to establish a trust relationship between PingFederate and AWS Organizations.
  5. E
    Log in as the AWS Organizations management account root user to configure individual IAM role trust policies for each user in PingFederate.

Answer

Configure SAML 2.0 federation between PingFederate and AWS IAM Identity Center by exchanging metadata, and enable System for Cross-domain Identity Management (SCIM) provisioning in AWS IAM Identity Center and configure the SCIM endpoint and access token in PingFederate.
To integrate an external Identity Provider (IdP) like PingFederate with AWS IAM Identity Center, you first establish federated single sign-on (SSO) trust by exchanging SAML 2.0 metadata between the provider and AWS. To automate user and group provisioning without manual setup, you enable SCIM in AWS IAM Identity Center and configure the SCIM endpoint and bearer token in PingFederate to sync directory changes automatically.

Step-by-Step Solution

1
Establish a SAML 2.0 trust relationship
Federated authentication is enabled between PingFederate and AWS IAM Identity Center by exchanging the metadata XML files.
This allows remote editors to authenticate using their existing corporate credentials.
2
Enable and configure SCIM provisioning
Automatic identity synchronization is established using the SCIM endpoint URL and bearer token provided by AWS IAM Identity Center.
This automates user and group management without requiring manual user creation or custom replication scripts.

Key Concept

Centralized identity federation and automatic provisioning using AWS IAM Identity Center with SAML 2.0 and SCIM.
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic