Examkin

Soru

Zorluk: OrtaIdentity and Access Management Architecture

A security architect is designing an authentication framework for a native mobile application that authenticates users against an enterprise Identity Provider using OpenID Connect. Because native applications are public clients that cannot securely store a static client secret, the architect must mitigate the risk of authorization code interception attacks on the device operating system. Which mechanism should be integrated into the authorization code flow to address this vulnerability?

  1. Proof Key for Code Exchange (PKCE) to cryptographically bind the token request to the initial authorization requestCevap
  2. B
    Role-Based Access Control (RBAC) policies enforced at the Identity Provider to validate user permission assignments before issuing authorization codes
  3. C
    IP address allowlisting on the Identity Provider token endpoint to restrict requests to known cellular network gateway ranges
  4. D
    SAML 2.0 Web Browser Single Sign-On profile relying on client-side HTTP POST bindings with static X.509 private keys embedded in the application binary

Cevap

Proof Key for Code Exchange (PKCE) to cryptographically bind the token request to the initial authorization request
Proof Key for Code Exchange (PKCE) is an extension to the OAuth 2.0 authorization code flow specifically created for public clients like native mobile apps. It dynamically generates a unique secret (code verifier) and sends a hashed version (code challenge) during the initial authorization request. When exchanging the authorization code for tokens, the app sends the original verifier. Because an eavesdropping app on the device lacks the verifier, intercepted authorization codes cannot be redeemed.

Adım Adım Çözüm

1
Analyze the client type and architectural security boundary
Native mobile applications are public clients that cannot maintain confidentiality of static client secrets embedded within app code.
Identifying client security capabilities determines which OAuth 2.0 protocol extensions must be applied.
2
Identify the threat vector described in the enterprise scenario
Malicious local applications on the operating system can register custom URI schemes to intercept authorization codes returned by the browser redirect.
Understanding code interception dictates the need for a dynamic request-binding cryptographic mechanism.
3
Select the standard cryptographic extension designed for public client authorization flows
Proof Key for Code Exchange (PKCE) creates a high-entropy secret (code verifier) and sends its transformation (code challenge) during authorization, validating it at token exchange.
PKCE ensures that even if an authorization code is intercepted, an attacker cannot redeem it for access tokens without the original code verifier.

Anahtar Kavram

PKCE in OAuth 2.0 / OIDC IAM Architecture for Public Clients
Bu soruyu puanla

Konular

Identity and Access Management Architecture

Bu konudan daha fazla soru