220-1102 Question 347
Single answerSecurity Assertions Markup Language (SAML)A company recently moved its cloud HR application to federated sign-in. Users can log in to the company portal successfully, but when they click the HR app tile, they receive an error stating that the identity assertion is invalid. The technician verifies that the users' passwords are correct and that the HR app itself is online. Which of the following is the MOST likely cause of the problem?
- A
A mismatch in SAML configuration between the identity provider and the service provider, such as the certificate or assertion settings
- B
The users need to clear browser cookies because SAML requires local credential storage for each application
- C
The HR application is using NTFS permissions that block federated sign-in requests
- D
The company portal must be joined to the local Active Directory domain for SAML to function
Show answer and explanation
Correct answer: A
Explanation
This scenario tests practical understanding of how SAML single sign-on works. With SAML, the user authenticates to an identity provider, which then sends a signed assertion to the service provider. If the user can access the company portal but the target cloud app rejects the login with an invalid assertion message, the most likely issue is a mismatch in SAML federation settings. Common examples include an expired or incorrect signing certificate, wrong assertion consumer service (ACS) URL, issuer mismatch, audience restriction mismatch, or time synchronization problems causing assertions to appear expired or not yet valid. This aligns with standard SAML deployment troubleshooting guidance from major identity and cloud providers, which consistently emphasizes validating IdP-SP metadata, certificates, URLs, and claim settings when assertion validation fails.
- A. Correct.
Correct. SAML depends on a trust relationship between the identity provider (IdP) and the service provider (SP). If the signing certificate, issuer, audience, ACS URL, clock settings, or other assertion-related parameters do not match, the SP may reject the assertion as invalid. In a real-world SSO deployment, this is one of the most common causes when authentication to the portal succeeds but access to the target app fails.
- B. Incorrect.
Incorrect. Clearing cookies can sometimes resolve session issues, but SAML does not require each application to store separate local credentials in the browser. The specific error about an invalid assertion points more directly to a federation or trust configuration issue rather than a local browser cache problem.
- C. Incorrect.
Incorrect. NTFS permissions apply to files and folders on Windows file systems. They are unrelated to validating SAML assertions between an IdP and a cloud service provider. This distractor reflects a common mistake of confusing local resource authorization with web-based federated authentication.
- D. Incorrect.
Incorrect. SAML is an XML-based standard for exchanging authentication and authorization data between an IdP and an SP, often across cloud services. The portal does not need to be domain-joined locally for SAML to work. Domain membership may be part of the organization's internal identity design, but it is not a direct requirement for SAML assertion validation.