Security Operations · Topic 9 of 13
Identity Lifecycle and Federation
Security+ identity management: provisioning, deprovisioning, privilege creep, attestation, SSO, federation, SAML, OAuth, OpenID Connect and LDAP.
- 4 min
- Includes a diagram
- Provisioning creates accounts, and deprovisioning removes access when it is no longer needed.
- Privilege creep is the build up of unneeded permissions, and access reviews remove it.
- Attestation is the periodic confirmation that access is still needed.
What it is
Identity and access management (IAM) is the set of processes and tools that decide who a user is and what that user may do. The identity lifecycle follows an account from creation to removal.
Federation and single sign-on (SSO) let one trusted identity work across many systems. This page covers the lifecycle and the protocols behind sharing identity.
How it works
Provisioning and deprovisioning
Provisioning creates an account and grants the access the role needs. Deprovisioning removes or disables accounts and access when a person leaves or changes roles.
Delays in deprovisioning leave live accounts for people who no longer need them. That is a common source of insider incidents. Automation linked to human resources systems shortens the gap.
Permission assignments and implications
Permissions should follow the person's role and be reviewed when the role changes. Over time, people collect more access than they need, a problem known as privilege creep. Regular reviews remove excess access.
Identity proofing and attestation
Identity proofing confirms that a person is who they claim before an account is issued, for example by checking documents. Attestation is the periodic confirmation by managers or owners that users still need their access.
Single sign-on and federation
SSO lets a user sign in once and reach several applications. Federation extends this across organizations or domains, so a user from one organization can sign in to another's system using their home identity.
| Protocol | Purpose |
|---|---|
| Security Assertion Markup Language (SAML) | An Extensible Markup Language (XML) based standard that passes sign in assertions from an identity provider to a service provider |
| OAuth | A framework for delegating access, where an application gets a token to act for a user without learning the password |
| OpenID Connect (OIDC) | An identity layer on OAuth 2.0 that confirms who the user is |
| Lightweight Directory Access Protocol (LDAP) | A protocol to query and manage a directory of users and groups |
The identity provider (IdP) authenticates the user. The service provider (SP) trusts the assertion and grants access.
OAuth is about authorization, not login. A common case is a calendar tool asking for limited access to your email account with a token you approve.
Interoperability
Different systems must work together, so standards such as SAML, OAuth and LDAP matter. When products do not share a standard, extra connectors or manual accounts are needed, and these add risk and effort.
Benefits and risks of SSO
| Benefit | Risk |
|---|---|
| Fewer passwords to remember | A compromised SSO account opens many systems |
| Central control and logging | The identity provider becomes a critical target |
| Easier deprovisioning | Outage of the provider can block access |
Protect SSO accounts with multifactor authentication, and monitor sign in activity closely.
What to remember for the exam
- Provisioning creates accounts, and deprovisioning removes access when it is no longer needed.
- Privilege creep is the build up of unneeded permissions, and access reviews remove it.
- Attestation is the periodic confirmation that access is still needed.
- Identity proofing verifies identity before an account is issued.
- SAML passes sign in assertions between an identity provider and a service provider.
- OAuth delegates access with tokens. OpenID Connect adds identity on top of it.
- LDAP queries a directory, and its secure form is LDAP over Transport Layer Security (TLS), known as LDAPS.
- SSO improves convenience but concentrates risk, so protect it with multifactor authentication (MFA).
When the question asks which protocol lets an app access your data without your password, the answer is OAuth. When it asks for web sign in across organizations, think SAML.
Common mistakes
Calling OAuth an authentication protocol. It authorizes access. OpenID Connect adds authentication.
Slow deprovisioning. An account that stays active after someone leaves is a risk.
Confusing federation with SSO. SSO is one login for many applications, while federation extends trust between organizations.
Forgetting to review access. Without attestation, permissions pile up.
Treating the identity provider as just another server. It is the key to many systems and needs strong protection.
Disable or remove accounts immediately when employment ends. Do not wait for a batch process.
Check yourself
What is privilege creep?
The gradual build up of permissions beyond what a person's current role needs.
Which protocol delegates access with a token and does not share the user's password?
OAuth.
What does an identity provider do in federation?
It authenticates the user and passes an assertion that the service provider trusts.
Topic 9 of 13 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.