Examkin

Question

Difficulty: MediumIdentity and Access Management Architecture

A financial enterprise is integrating a legacy on-premises web application—which natively authenticates internal users via Kerberos tickets—with a modern cloud-based Identity Provider (IdP) to support federated single sign-on (SSO) for remote workers. The architecture must enable remote users to authenticate against the cloud IdP while ensuring internal domain controllers and Kerberos Key Distribution Centers (KDCs) are not directly exposed to external network traffic. Which IAM architectural solution best meets these requirements?

  1. Deploy an Identity-Aware Reverse Proxy in a demilitarized zone that validates cloud IdP assertions and utilizes Kerberos Constrained Delegation to impersonate authenticated users to the backend applicationAnswer
  2. B
    Configure perimeter next-generation firewalls to directly route inbound LDAP authentication requests from remote endpoints to internal Active Directory domain controllers
  3. C
    Configure backend application role-based access control lists to grant authorization rights to remote users prior to validating identity tokens from the cloud IdP
  4. D
    Install host-based intrusion detection software on legacy web servers to log unauthenticated incoming HTTP requests after they reach internal database endpoints

Answer

Deploying an Identity-Aware Reverse Proxy that validates cloud IdP assertions and performs Kerberos Constrained Delegation (KCD) is the correct architectural solution.
Deploying an Identity-Aware Proxy equipped with Kerberos Constrained Delegation (KCD) bridges the gap between modern cloud single sign-on assertions (such as SAML or OIDC) and legacy internal ticket-based authentication. The proxy validates external user identities with the cloud Identity Provider and subsequently requests a Kerberos ticket on behalf of the user to access the legacy application, all while keeping internal domain controllers isolated from direct internet access.

Step-by-Step Solution

1
Analyze the IAM architectural requirements
Identified the need to bridge modern web federation protocols (used by the cloud IdP) with legacy ticket-based protocols (Kerberos used by internal applications) without exposing internal domain infrastructure to the internet.
Remote users authenticate externally using web tokens (SAML/OIDC), whereas the legacy application expects internal Kerberos tickets.
2
Evaluate protocol translation and gateway components
An Identity-Aware Reverse Proxy operating at the network perimeter can authenticate the external user assertion from the cloud IdP and perform Kerberos Constrained Delegation (KCD) on the internal side.
KCD allows the gateway to securely request a Kerberos service ticket on behalf of the authenticated user to grant access to backend legacy applications.
3
Verify security boundary compliance
Domain Controllers and KDCs remain isolated in the internal network segment behind the proxy layer.
Prevents direct external exposure of core enterprise identity services.

Key Concept

Protocol Transition and Gateway Integration in IAM Architecture
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic