A cybersecurity analyst needs to implement secure authentication to third-party websites without users' passwords. Which of the following would be the BEST way to achieve this objective?
Security Assertions Markup Language (SAML) tokens are XML representations of claims. By default, SAML tokens Windows Communication Foundation (WCF) uses in federated security scenarios are issued tokens. SAML tokens carry statements that are sets of claims made by one entity about another entity.
https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/saml-tokens-and-claims#:~:text=Security%20Assertions%20Markup%20Language%20%28SAML%29%20tokens%20are%20XML,claims%20made%20by%20one%20entity%20about%20another%20entity.
Well damn. I thought I knew this one until I started thinking too much. I'm still heavily conflicted but leaning more towards SAML being correct...here's why: "SAML is an open standard that verifies identity and offers authentication" while "Oauth can mean Authentication or Authorization, for the OAuth protocol, we mean specifically authorization. This protocol is used to pass authorization from one user to another, all while protecting someone's username and password." https://www.okta.com/identity-101/saml-vs-oauth/
You changed the quote to confirm your bias. The exact wording is:
'While “auth” can mean Authentication or Authorization, for the OAuth protocol, we mean specifically authorization.'
https://www.okta.com/identity-101/saml-vs-oauth/
Where did you hear that SAML doesn't provide authentication?
Authentication is literally the primary purpose of SAML.
"Security assertion markup language (SAML) is an authentication process. Head to work in the morning and log into your computer, and you've likely used SAML.
Open authorization (OAuth) is an authorization process. Use it to jump from one service to another without tapping in a new username and password. If you're logged into Google and used those credentials for Hootsuite, you've used OAuth.
Both applications can be used for web single sign on (SSO), but SAML tends to be specific to a user, while OAuth tends to be specific to an application. The two are not interchangeable, so instead of an outright comparison, we’ll discuss how they work together."
https://www.okta.com/identity-101/saml-vs-oauth/
Answer A
Everyone experiences this option, for example you need access a website, the website asks you do you prefer access via your facebook account or Google account. Here you are no use password and username to connect to third party website.
A. OAuth
Security assertion markup language (SAML) is an authentication process. Head to work in the morning and log into your computer, and you've likely used SAML.
Open authorization (OAuth) is an authorization process. Use it to jump from one service to another without tapping in a new username and password. If you're logged into Google and used those credentials for Hootsuite, you've used OAuth.
Key word is the focus is on application or user??
The question. Says employees need to access meaning the focus is on people so it is SAML. But if the focus was on application it would have been ouath
Security assertion markup language (SAML) is an authentication process. Head to work in the morning and log into your computer, and you've likely used SAML.
Open authorization (OAuth) is an authorization process. Use it to jump from one service to another without tapping in a new username and password. If you're logged into Google and used those credentials for Hootsuite, you've used OAuth.
Both applications can be used for web single sign on (SSO), but SAML tends to be specific to a user, while OAuth tends to be specific to an application. The two are not interchangeable, so instead of an outright comparison, we’ll discuss how they work together.
Looks like provided answer might be right. SAML has also
been used for letting third-party applications authenticate to a host application (e.g., a gaming application that authenticates to a social network in
which the game resides). Over the years, several security issues with the
SAML protocol have been reported [66, 67]. The specific SAML implementation for Google applications was broken in 2008
As an example of a SAML implementation, Amazon Web Services (AWS) can function as a SAML service provider. This allows companies using AWS to develop cloud applications to manage their customers' user identities and provide them with permissions on AWS without having to create accounts for them on AWS directly.
References:
1. https://www.diva-portal.org/smash/get/diva2:921172/FULLTEXT01.pdf
2. COM501B
implement secure authentication to third-party websites without users' passwords ,
only SSO provide authentication, the question does not state both authentication and authorization if it was, the answer will be SAML it provide Authentication and authorization.
In the context of this question, main requirement appears to be "without users' passwords". My research goes with Option A. OAuth since SAML and SSO would require user to add credentials https://www.ubisecure.com/uncategorized/difference-between-saml-and-oauth/
It's NOT OAuth. As per professor Messer notes and his video he states that OAuth is used to give authorization to the resources and it uses OpenID connect that handles the single sign on as an authentication and then OAuth decides what resources should be provided it is basically an authorization.
The answer is correct (C), the analyst needs to establish secure authentication, so he needs to send data to a third-party website, So SAML is fine.
OAuth is used for a final user can use his credentials in another web or service without sharing all of his identity. IE if a user wants to use his Facebook information to log in to the Local Supermarket.
https://en.wikipedia.org/wiki/OAuth
So, OAuth does not deal with Authentication. So, in that case, SAML and SSO are valid options.
Source: https://www.ubisecure.com/uncategorized/difference-between-saml-and-oauth/#:~:text=SAML%20(Security%20Assertion%20Mark%2Dup,doesn't%20deal%20with%20authentication.
This section is not available anymore. Please use the main Exam Page.SY0-501 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
exiledwl
Highly Voted 4 years, 4 months agowho__cares123456789___
4 years, 4 months agosnellford
4 years, 2 months agoFNavarro
4 years, 2 months agozadams16
4 years, 2 months agoFNavarro
4 years, 2 months agogoodmate
Most Recent 1 year, 6 months agobolun
1 year, 9 months agophemendra
1 year, 10 months agoSophyQueenCR82
2 years, 2 months agoSophyQueenCR82
2 years, 2 months agofonka
3 years, 9 months agofonka
3 years, 9 months agoBrjy
3 years, 11 months agoDion79
3 years, 11 months agoLokiSecure
3 years, 12 months ago465ekm
4 years agosimo77
4 years, 1 month agoKihi
4 years, 2 months agonakres64
4 years, 2 months agobobthebuilder55110
4 years, 2 months agoHash___
4 years, 3 months agoDimitricl
4 years, 3 months agoHelloworld__
4 years, 3 months ago