Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security operations engineer is investigating an access issue where a newly provisioned systems administrator can successfully log in via SAML 2.0 Single Sign-On (SSO) to an enterprise cloud portal, but receives an HTTP 403 Forbidden error whenever attempting to open the database administration dashboard. The Identity Provider (IdP) SAML assertion log contains the following snippet:

xml
<saml:AttributeStatement>
<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/department">
<saml:AttributeValue>Database_Admins</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>

However, the dashboard Service Provider (SP) policy configuration requires an attribute claim key named `roles` with a value of `db-admin-access` to grant rights.

Which of the following identity and access management operational issues BEST describes the root cause of this access failure?

  1. Authentication succeeded at the Identity Provider, but authorization failed at the Service Provider due to a claim attribute mapping mismatch.Answer
  2. B
    Primary authentication failed at the Identity Provider because SAML assertions cannot transmit user identity attributes to web applications.
  3. C
    The Service Provider denied access because cloud management dashboards require implicitly trusted internal network perimeters rather than continuous attribute validation.
  4. D
    The HTTP 403 Forbidden status indicates a failure of a detective auditing control during the SSO flow rather than a preventive access control mechanism.

Answer

Authentication succeeded at the Identity Provider, but authorization failed at the Service Provider due to a claim attribute mapping mismatch.
In federated identity operations using SAML 2.0, authentication (verifying identity at the Identity Provider) and authorization (granting rights at the Service Provider) are distinct operations. The user successfully authenticated via SSO, but because the SAML assertion payload sent the attribute key 'department' instead of the SP's required claim key 'roles', the Service Provider could not map the user to the required authorization role, resulting in an HTTP 403 Forbidden response.

Step-by-Step Solution

1
Analyze the authentication log snippet from the Identity Provider (IdP).
The IdP log confirms successful SAML SSO authentication and demonstrates that the user identity was issued an attribute named 'department' with value 'Database_Admins'.
Verifying IdP logs confirms whether the authentication phase of AAA was completed.
2
Compare the IdP attribute payload against the Service Provider (SP) authorization requirements.
The SP expects a claim key of 'roles' with value 'db-admin-access', but receives 'department' with value 'Database_Admins'.
Authorization decisions depend on exact match of requested and configured claims.
3
Determine the operational root cause.
Authentication succeeded (who the user is), but authorization failed (what permissions the user has) due to mismatched SAML attribute mappings.
Distinguishing authentication from authorization highlights why valid user credentials can still result in HTTP 403 access denial.

Key Concept

Separation of Authentication and Authorization in SAML SSO Attribute Mapping
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic