Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security operations team is deploying a enterprise cloud application integrated with an internal Identity Provider (IdP) using SAML 2.0. Arrange the operational steps of a Service Provider-initiated (SP-initiated) Single Sign-On (SSO) authentication sequence in the correct chronological order from first to last.

  1. 1The user attempts to access a protected resource directly on the Service Provider (SP) web application without an active session.
  2. 2The Service Provider generates an XML-based SAML AuthnRequest and redirects the user's browser to the Identity Provider (IdP) Single Sign-On URL.
  3. 3The user authenticates with the Identity Provider and satisfies multi-factor authentication (MFA) requirements.
  4. 4The Identity Provider issues a digitally signed SAML Response containing an assertion and redirects the browser to the Service Provider's Assertion Consumer Service (ACS) URL.
  5. 5The Service Provider validates the digital signature of the SAML Assertion and establishes a local authenticated application session.

Answer

The correct operational sequence for SP-initiated SAML 2.0 SSO is: 1) Initial resource request to the SP, 2) Redirection with SAML AuthnRequest to the IdP, 3) User authentication at the IdP, 4) Redirection with signed SAML Assertion back to SP's ACS, and 5) Signature validation and session creation by the SP.
In SAML 2.0 SP-initiated Single Sign-On, the sequence begins with an unauthenticated request to the Service Provider. The SP redirects the user's browser with a SAML AuthnRequest to the Identity Provider. Next, the user authenticates directly at the IdP. Upon successful authentication, the IdP redirects the user back to the SP's Assertion Consumer Service (ACS) endpoint with a signed SAML Assertion containing identity attributes. Finally, the SP verifies the assertion signature and establishes the user session.

Step-by-Step Solution

1
Identify the entry point of the SP-initiated authentication workflow.
The user initiates contact by requesting access directly at the Service Provider application.
In SP-initiated SSO, the flow starts at the resource provider, unlike IdP-initiated SSO where the user visits the IdP portal first.
2
Determine how the Service Provider directs the user to the authentication authority.
The SP issues an HTTP redirect containing a SAML AuthnRequest targeted at the IdP SSO URL.
The SP cannot authenticate the user locally, so it delegates identity verification by redirecting the client browser.
3
Trace the primary authentication event at the Identity Provider.
The user supplies primary credentials and completes mandatory MFA challenges at the IdP portal.
Authentication occurs strictly between the user browser and the IdP, ensuring credentials are never exposed to the SP.
4
Trace the return path of identity claims to the Service Provider.
The IdP redirects the browser to the SP's Assertion Consumer Service (ACS) with a signed SAML Response assertion.
The SAML assertion serves as cryptographically verifiable proof that the user successfully authenticated at the IdP.
5
Finalize session establishment and access authorization.
The SP validates the digital signature using the IdP's public key certificate and logs the user into the local application context.
Verifying the signature ensures the assertion came from a trusted IdP and was not altered during transit by a man-in-the-middle.

Key Concept

SAML 2.0 SP-Initiated Authentication Flow
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic