Examkin

Question

Difficulty: MediumIdentity and Access Management Architecture

An enterprise security architect is designing a hybrid Identity and Access Management (IAM) solution to enable Single Sign-On (SSO) for employees accessing both legacy on-premises systems and cloud-hosted web applications. The legacy systems rely on internal Active Directory Domain Services (AD DS) and Kerberos tickets, whereas the cloud applications require SAML 2.0 security assertions. Which of the following architectural controls and components must be deployed to support this hybrid authentication design? (Select TWO.)

  1. An Identity Provider (IdP) federation bridge to translate internal Active Directory authentication states into signed SAML assertion tokens for cloud applications.Answer
  2. An on-premises directory connector agent to synchronize user identity attributes and securely validate credentials against internal domain controllers.Answer
  3. C
    A RADIUS server configured with EAP-TLS client certificates to act as the primary SAML assertion token broker for web browser sessions.
  4. D
    An OAuth 2.0 authorization server enforcing the Resource Owner Password Credentials (ROPC) grant type to establish implicit perimeter trust for internal traffic.

Answer

The correct architecture requires deploying an Identity Provider (IdP) federation bridge to convert internal directory authentication states into SAML assertions, alongside an on-premises directory connector agent to synchronize user attributes and validate credentials.
In a hybrid IAM architecture, connecting legacy Active Directory environments with cloud web applications requires two primary components: an Identity Provider (IdP) federation bridge (such as AD FS or a cloud IdP bridge) to generate SAML tokens for web service providers, and a directory connector agent to synchronize identities and delegate password validation back to on-premises domain controllers.

Step-by-Step Solution

1
Analyze the identity requirements across environments.
On-premises legacy systems require Active Directory and Kerberos, while cloud applications rely on SAML 2.0 web assertions.
Cloud software-as-a-service applications cannot directly consume Kerberos tickets generated by internal domain controllers over the internet.
2
Identify the federation requirement for SAML token generation.
Deploying an Identity Provider (IdP) federation bridge allows the organization to authenticate users internally and issue signed SAML assertions to cloud application Service Providers (SPs).
Federation bridges bridge the gap between internal network authentication protocols and external web token standards.
3
Identify the identity lifecycle and validation component.
Deploying an on-premises directory connector syncs account objects and forwards credential validation requests securely.
The cloud IdP requires up-to-date user object attributes and a secure pathway to verify passwords against internal Active Directory domain controllers.

Key Concept

Hybrid Identity and Federation Architecture
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic