A financial services organization is designing a modern Identity and Access Management (IAM) architecture. The organization needs to grant a third-party analytics application permission to read transaction history from its internal API on behalf of authenticated end users. Company security policy mandates that end-user credentials must never be exposed to or stored by the third-party application, and access rights must be scoped specifically for API data delegation without transferring identity authentication assertions. Which of the following identity and access management frameworks should the security architect select to meet these requirements?
- OAuth 2.0 framework utilizing authorization grant tokens to delegate scoped API accessAnswer
- BSAML 2.0 service provider-initiated federation exchanging XML authentication assertions
- CCentralized RADIUS server deployment enforcing EAP-TLS mutual certificate verification
- DKerberos ticket-granting service operating over trusted internal domain controller paths
Answer
The OAuth 2.0 framework utilizing authorization grant tokens to delegate scoped API access is the correct solution because OAuth 2.0 is specifically tailored for delegated API access without sharing user credentials.
The correct answer specifies OAuth 2.0 utilizing authorization grant tokens. OAuth 2.0 is designed specifically for delegated authorization, allowing a third-party application to request limited access (scopes) to a user's resources hosted by an HTTP service without requiring the user to disclose their credentials to the application.
Step-by-Step Solution
Key Concept
Delegated API Authorization with OAuth 2.0
Estimated Time:1m 30s