Question

An organization is improving its web services to enable better customer engagement and self-service. The organization has a native mobile application and a rewards portal provided by a third party.

The business wants to provide customers with the ability to log in once and have SSO between each of the applications. The integrity of the identity is important so it can be propagated through to back-end systems to maintain a consistent audit trail.

Which of the following authentication and authorization types BEST meet the requirements?

A. SAML
B. Social login
C. OpenID connect
D. XACML
E. SPML
F. OAuth

Answer 1

The best technologies to achieve SSO with a strong identity integrity for audit trails are SAML, OpenID Connect, and OAuth, with SAML likely being the best choice for enterprise applications. Option A,C,F are correct.

Step-by-step explanation:

The organization is seeking to implement a solution that allows customers to log in once and maintain Single Sign-On (SSO) capabilities across different applications while ensuring the integrity of the user identity for consistent audit trails. The best authentication and authorization types that meet these requirements are:

SAML (Security Assertion Markup Language): This is an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. It supports SSO and is widely adopted in enterprise environments.

OpenID Connect: It is an authentication layer on top of OAuth 2.0, allowing applications to verify the identity of users and obtain basic profile information in an interoperable and REST-like manner.

OAuth: An authorization framework that enables applications to obtain limited access to user accounts on an HTTP service. It's used by , , and Microsoft for third-party authentication.

SAML would be the most appropriate for enterprise applications requiring strong integrity for audit trails. OpenID Connect would be suitable if the organization also requires access to user profile information. Since the question emphasizes identity integrity, SAML would likely be the best choice. OAuth can be part of the solution but by itself does not ensure identity propagation; it's more about granting access with tokens.