SY0-701 Question 353
Single answerSingle sign-on (SSO), Lightweight Directory Access Protocol (LDAP), Open authorization (OAuth), Security Assertions Markup Language (SAML)A company uses an on-premises Active Directory environment as its central identity source and wants employees to sign in once to access a newly adopted cloud-based HR application. The HR vendor states that the application can trust assertions from an external identity provider, and the security team wants to avoid storing duplicate passwords in the cloud application. Which solution BEST meets these requirements?
- A
Integrate the HR application with SAML so the company identity provider can authenticate users and send signed assertions for SSO
- B
Use LDAP directly from the cloud HR application to bind to the domain controllers over the internet for user authentication
- C
Implement OAuth so the HR application can authenticate users with Active Directory usernames and passwords
- D
Configure local accounts in the HR application and synchronize passwords nightly from Active Directory
Show answer and explanation
Correct answer: A
Explanation
The best answer is the SAML-based federation option. In enterprise environments, SAML is a standard approach for providing SSO from an internal identity provider to a SaaS application. The identity provider authenticates the user against the organization's existing directory-backed system, such as Active Directory, and then sends signed assertions to the service provider. This allows the SaaS application to trust the enterprise authentication result without storing separate passwords. LDAP is useful for directory queries and some authentication use cases, but it is not typically the best solution for internet-facing SaaS federation. OAuth, per RFC 6749, is an authorization framework rather than a direct authentication standard; authentication in modern web apps is more appropriately handled with OpenID Connect, while many enterprise SaaS applications still widely support SAML 2.0 for SSO. Best practices from vendors such as Microsoft, Okta, and other identity providers consistently recommend federation via SAML or OIDC instead of password replication into cloud services.
- A. Correct.
Correct. SAML is commonly used for enterprise single sign-on between an organization's identity provider and a cloud service provider. In this scenario, the company can keep authentication with its existing identity system and provide the HR application with signed SAML assertions indicating the user's identity and authentication status. This supports SSO and avoids storing duplicate passwords in the cloud application.
- B. Incorrect.
Incorrect. LDAP is a directory access protocol used to query and manage directory information, and it can be used for authentication in some environments. However, exposing domain controllers directly to a cloud SaaS application over the internet is generally not the best design for federated SSO. It does not align well with modern cloud federation patterns and increases security and connectivity concerns.
- C. Incorrect.
Incorrect. OAuth is primarily an authorization framework for delegated access to resources, not a primary enterprise authentication protocol for browser-based SSO into SaaS applications. Someone might choose this because OAuth is often associated with logging in to applications, but that typically involves OpenID Connect layered on OAuth for authentication, not OAuth alone.
- D. Incorrect.
Incorrect. Creating local accounts with password synchronization introduces duplicate credential storage and additional management overhead. It also does not provide true federated SSO, since the cloud application still maintains its own credential store. This approach increases risk and is less aligned with best practices for centralized identity and access management.