Examkin

Question

Difficulty: MediumIdentity and Access Management Architecture

An organization is migrating its enterprise authentication framework to a modern cloud Identity Provider (IdP) supporting OpenID Connect (OIDC). However, several legacy internal web applications only support HTTP header-based authentication and cannot natively process OIDC tokens. Which of the following architectural components should be deployed between the legacy applications and the cloud IdP to translate federated identity assertions into secure local application headers?

  1. An Identity-Aware Proxy (IAP) acting as a reverse proxy to authenticate requests via the cloud IdP and inject validated identity headers to the target applicationsAnswer
  2. B
    A RADIUS server configured to convert OIDC tokens into AAA access requests for web application header injection
  3. C
    An internal perimeter firewall enforcing IP-based Access Control Lists (ACLs) to implicitly trust incoming web session headers
  4. D
    An OAuth 2.0 authorization server that re-writes HTTP header attributes during authorization code grant exchanges

Answer

An Identity-Aware Proxy (IAP) acting as a reverse proxy to authenticate requests via the cloud IdP and inject validated identity headers to the target applications
An Identity-Aware Proxy (IAP) acts as an intermediary reverse proxy. It intercepts user web traffic, redirects unauthenticated requests to the cloud IdP for OIDC authentication, and upon successful authentication, attaches verified identity attributes as secure HTTP headers before forwarding requests to legacy target applications.

Step-by-Step Solution

1
Analyze the architectural gap between modern authentication protocols and legacy application capabilities.
Identified that the cloud IdP issues OIDC tokens while legacy applications require HTTP header injection.
Legacy applications cannot be modified directly to parse federated JSON Web Tokens (JWTs).
2
Evaluate access control proxy components capable of token translation and session mediation.
An Identity-Aware Proxy (IAP) intercepts incoming application traffic, authenticates via the cloud IdP, and injects validated identity header values.
IAPs function as application-level reverse proxies designed specifically to bridge modern IdP identity assertions with legacy web applications.

Key Concept

Identity-Aware Proxy (IAP) and legacy application integration in IAM architecture
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic