Your company implemented Federated Identity Management (FIM) based on SAML to support Single Sign-On (SSO). Which of the following is not true? (Source: Wentz QOTD)
A. A user may have an identity in each domain and multiple identities across domains.
B. A federated identity is a pseudonym shared between domains to hide a user’s identity.
C. A relying party authorizes access requests based on assertions expressed in XACML.
D. SSO relies on the service provider’s (SP) trust in the Identity Provider (IdP).

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is C. A relying party authorizes access requests based on assertions expressed in XACML.

Source: Security Assertion Markup Language (SAML) V2.0 Technical Overview

As the diagram above shows:

• A user may have an identity in each domain and multiple identities across domains. For example, John Doe registered three accounts in three systems as follows:
  • JohnDoe in airline.example.com
  • JDoe in cars.example.co.uk
  • JohnD in hotels.example.ca
• A federated identity is a pseudonym shared between domains to hide a user’s identity. For instance, both pseudonyms azqu3H7 and f78q9c0 refer to the user, John Doe.
  • azqu3H7 is the pseudonym agreed between airline.example.com and cars.example.co.uk.
  • f78q9c0 is the pseudonym agreed between airline.example.com and hotels.example.ca.
• A relying party authorizes access requests based on assertions expressed in SAML.
  • SAML provides a standard way to render assertions that work across systems and security domains.
  • SAML assertions are input for the relying parties or service providers to make authorization decisions. Authorization can be based on XACML.
• SSO relies on the service provider’s (SP) trust in the Identity Provider (IdP).

The OASIS Security Assertion Markup Language (SAML) standard defines an XML-based framework for describing and exchanging security information between on-line business partners. This security information is expressed in the form of portable SAML assertions that applications working across security domain boundaries can trust. The OASIS SAML standard defines precise syntax and rules for requesting, creating, communicating, and using these SAML assertions.

Federated identity

• Users often have individual local user identities within the security domains of each partner with which they interact.
• Identity federation provides a means for these partner services to agree on and establish a common, shared name identifier to refer to the user in order to share information about the user across the organizational boundaries.
• The user is said to have a federated identity when partners have established such an agreement on how to refer to the user.

Single Sign-On

SAML solves the multi-domain SSO (MDSSO) problem by providing a standard vendor-independent grammar and protocol for transferring information about a user from one web server to another independent of the server DNS domains.

Source: Security Assertion Markup Language (SAML) V2.0 Technical Overview

Reference

• Security Assertion Markup Language (SAML) V2.0 Technical Overview