ISC2 CISSP (Certified Information Systems Security Professional)Identity and Access Management (IAM)Medium
A large enterprise is implementing a new federated identity management system to allow employees to access multiple cloud applications with a single set of credentials. The security architect is evaluating a protocol that enables the secure exchange of authentication and authorization data between an identity provider and a service provider over the internet. Which of the following protocols is best suited for this requirement?
- ASAML
- BLDAP
- CTACACS+
- DKerberos
Show answer & explanationAnswer & explanation
Correct answer: A. SAML
SAML (Security Assertion Markup Language) is specifically designed for exchanging authentication and authorization data between an identity provider and a service provider, making it ideal for federated identity management in cloud environments. It enables single sign-on (SSO) across disparate systems.
Why the other options are wrong
- B. LDAP is primarily a directory service protocol used for storing and retrieving information, not for federated identity exchange between different domains.
- C. TACACS+ is a proprietary Cisco protocol used for centralized authentication, authorization, and accounting (AAA) for network devices, not for federated identity management for cloud applications.
- D. Kerberos is an authentication protocol that relies on shared secrets and is typically used within a single, trusted domain, not for federated identity across different organizations or cloud services.
SAML (Security Assertion Markup Language)
An XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider.
- Enables Single Sign-On (SSO) across disparate systems.
- Used extensively in federated identity management.
- Defines XML-based assertions for identity and attributes.
Memory trick: Federated systems SAML a secure bridge, while others mind their own domain.