Examkin

Soru

Zorluk: OrtaIdentity and Access Management Architecture

An organization is migrating its enterprise authentication framework to a modern cloud Identity Provider (IdP) supporting OpenID Connect (OIDC). However, several legacy internal web applications only support HTTP header-based authentication and cannot natively process OIDC tokens. Which of the following architectural components should be deployed between the legacy applications and the cloud IdP to translate federated identity assertions into secure local application headers?

  1. An Identity-Aware Proxy (IAP) acting as a reverse proxy to authenticate requests via the cloud IdP and inject validated identity headers to the target applicationsCevap
  2. B
    A RADIUS server configured to convert OIDC tokens into AAA access requests for web application header injection
  3. C
    An internal perimeter firewall enforcing IP-based Access Control Lists (ACLs) to implicitly trust incoming web session headers
  4. D
    An OAuth 2.0 authorization server that re-writes HTTP header attributes during authorization code grant exchanges

Cevap

An Identity-Aware Proxy (IAP) acting as a reverse proxy to authenticate requests via the cloud IdP and inject validated identity headers to the target applications
An Identity-Aware Proxy (IAP) acts as an intermediary reverse proxy. It intercepts user web traffic, redirects unauthenticated requests to the cloud IdP for OIDC authentication, and upon successful authentication, attaches verified identity attributes as secure HTTP headers before forwarding requests to legacy target applications.

Adım Adım Çözüm

1
Analyze the architectural gap between modern authentication protocols and legacy application capabilities.
Identified that the cloud IdP issues OIDC tokens while legacy applications require HTTP header injection.
Legacy applications cannot be modified directly to parse federated JSON Web Tokens (JWTs).
2
Evaluate access control proxy components capable of token translation and session mediation.
An Identity-Aware Proxy (IAP) intercepts incoming application traffic, authenticates via the cloud IdP, and injects validated identity header values.
IAPs function as application-level reverse proxies designed specifically to bridge modern IdP identity assertions with legacy web applications.

Anahtar Kavram

Identity-Aware Proxy (IAP) and legacy application integration in IAM architecture
Bu soruyu puanla

Konular

Identity and Access Management Architecture

Bu konudan daha fazla soru