Examkin

Question

Difficulty: Very hardIdentity and Access Management Architecture

An enterprise security architect is designing an Identity and Access Management (IAM) architecture to support modern cloud applications, API access, network administration, and automated user lifecycle management. Match each IAM protocol or specification on the left to its corresponding architectural use case on the right.

  • SAML 2.0XML-based federation standard that exchanges authentication and authorization assertions between an Identity Provider (IdP) and a Service Provider (SP) across web domains.
  • OAuth 2.0HTTP-based delegation framework that issues scoped access tokens to third-party applications for API access without exposing user credentials.
  • OpenID Connect (OIDC)Authentication protocol layer built on top of OAuth 2.0 that provides user identity verification and profile data via JSON Web Tokens (JWTs).
  • TACACS+Network administrative AAA protocol that encrypts the entire packet payload and separates authentication, authorization, and accounting operations.
  • SCIMOpen specification using REST APIs to automate the standardized provisioning, updating, and deprovisioning of user identities across enterprise systems.

Answer

SAML 2.0 matches XML-based federation assertion exchange between IdP and SP; OAuth 2.0 matches API authorization and access token delegation; OpenID Connect (OIDC) matches user identity authentication layer over OAuth using JWT ID tokens; TACACS+ matches full-payload encrypted network AAA separating authN and authZ; SCIM matches automated identity provisioning/deprovisioning REST standard.
Each IAM technology fulfills a distinct architectural role within enterprise security. SAML 2.0 facilitates XML assertion-based web browser federation SSO across organizations. OAuth 2.0 governs delegated access authorization to protected resources via tokens. OpenID Connect operates on top of OAuth 2.0 to add authentication capability using JWT ID tokens. TACACS+ provides secure administrative AAA for network appliances with full payload encryption and command-level authorization decoupling. SCIM provides standard REST endpoints to automate identity provisioning and account lifecycle operations across enterprise and cloud services.

Step-by-Step Solution

1
Analyze SAML 2.0 functionality.
Identified SAML 2.0 as an XML-based federated SSO standard that passes security assertions between Identity Providers and Service Providers.
SAML relies on XML payload assertions across cross-domain boundaries.
2
Analyze OAuth 2.0 functionality.
Identified OAuth 2.0 as an authorization framework that delegates scoped API access tokens to applications.
OAuth 2.0 provides delegated authorization rather than direct authentication.
3
Analyze OpenID Connect (OIDC) functionality.
Identified OIDC as an authentication extension on top of OAuth 2.0 utilizing JSON Web Tokens (JWTs).
OIDC fills the authentication gap in OAuth 2.0 by introducing standardized ID tokens.
4
Analyze TACACS+ network administrative AAA properties.
Identified TACACS+ as encrypting the entire packet body and decoupling authentication from command authorization.
Unlike RADIUS, TACACS+ separates AAA functions and provides full payload encryption.
5
Analyze SCIM protocol functionality.
Identified SCIM as an open standard protocol for automating cloud identity provisioning and deprovisioning.
SCIM uses RESTful Web APIs and standardized JSON/XML schemas to manage identity lifecycle changes across disparate SaaS systems.

Key Concept

Identity and Access Management Architecture Protocols and Frameworks
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic