Examkin

Soru

Zorluk: OrtaIdentity and Access Management Architecture

A security architect is designing an authentication and authorization framework for a newly developed microservices-based web application. The architectural design requires a lightweight, stateless mechanism to securely transport identity claims and delegated authorization scopes between independent API endpoints without maintaining server-side session state or performing repeated directory database lookups for each call. Which of the following IAM standards should the architect implement?

  1. A
    Lightweight Directory Access Protocol over TLS (LDAPS) with central session caching
  2. OpenID Connect (OIDC) combined with OAuth 2.0 using JSON Web Tokens (JWT)Cevap
  3. C
    Terminal Access Controller Access-Control System Plus (TACACS+) with centralized AAA policies
  4. D
    Security Assertion Markup Language (SAML 2.0) with XML-encoded assertions for inter-service RPC

Cevap

The architect should implement OpenID Connect (OIDC) combined with OAuth 2.0 using JSON Web Tokens (JWT).
OpenID Connect (OIDC) built on top of OAuth 2.0 issues JSON Web Tokens (JWT) containing cryptographically signed claims and scopes. Microservices can independently verify these lightweight tokens using public key cryptography, eliminating the need to maintain server session state or query a central database for every API request.

Adım Adım Çözüm

1
Analyze the microservices requirement for stateless identity and authorization propagation.
Identified the need for self-contained, digitally signed tokens that carry claims without requiring server-side session lookup databases.
Microservice architectures scale best when services do not maintain centralized session state.
2
Evaluate candidate protocols against REST/API performance and statelessness criteria.
OAuth 2.0 provides delegated authorization, OIDC adds an identity layer, and JWT provides lightweight JSON payload structures ideal for HTTP headers.
JSON Web Tokens can be validated independently by microservices using public key cryptography without calling back to the identity provider.

Anahtar Kavram

Stateless API Authentication and Authorization via OIDC/OAuth 2.0 JWTs
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Identity and Access Management Architecture

Bu konudan daha fazla soru