A security engineer is integrating an identity provider (IdP) with an internal web application using OpenID Connect (OIDC) and OAuth 2.0. During testing, users successfully authenticate at the IdP prompt and receive a valid ID token verifying their credentials. However, when the web application presents the accompanying access token to a backend microservice to update sensitive records, the backend service returns an HTTP 403 Forbidden status code because the token is missing the required write permission scope. Which core pillar of the AAA framework is directly failing in this scenario, and why?
- Authorization, because while user identity was verified during authentication, the access token lacks the required permissions scope to perform the requested operation.Cevap
- BAuthentication, because the backend microservice failed to validate the identity of the user presenting the access token before evaluating permissions.
- CAccounting, because the API gateway failed to log the user's session state and request payload prior to passing the token to the microservice.
- DAuthorization, because internal microservice communication within a trusted perimeter network should bypass token scope checks entirely.
Cevap
Authorization failed because user identity was successfully authenticated, but the issued access token lacked the required permission scopes to perform the requested operation.
The correct response highlights that Authorization is the specific AAA component failing. Authentication was successfully completed when the identity provider verified the user's credentials and issued the ID token. However, when requesting the backend resource, the access token lacked the required scope attributes to permit write operations, resulting in an authorization failure (HTTP 403 Forbidden).
Adım Adım Çözüm
Anahtar Kavram
Distinction between Authentication (proving identity) and Authorization (granting permissions) within OAuth 2.0 / OIDC and AAA frameworks
Tahmini Süre:2m 0s