Security Architecture · Topic 7 of 12
Authentication and Federation Design
Design authentication with MFA, passkeys, SSO and federation using SAML, OAuth and OpenID Connect, plus conditional access and identity proofing.
- 5 min
- MFA needs different factor types, and two passwords are not MFA.
- Phishing resistant methods are hardware keys and passkeys using FIDO2 and WebAuthn.
- SAML is XML based web SSO, OAuth 2.0 is authorization, OIDC adds authentication to OAuth.
What it is
Authentication proves who or what is requesting access. Architects choose methods and protocols that balance security, usability and cost across many applications.
Federation lets one organization trust identities issued by another, so users do not need a separate account everywhere. Single sign on (SSO) lets a user authenticate once and reach many applications.
How it works
Factors and stronger methods
Multi factor authentication (MFA) combines different types of evidence: something you know, something you have, something you are, and sometimes where you are. Two passwords are one factor type twice, not MFA.
| Method | Strength | Weakness |
|---|---|---|
| Password | Familiar | Phished, reused, guessed |
| One time code by Short Message Service (SMS) text | Easy | Can be intercepted or redirected through swapping the subscriber identity module (SIM) |
| Authenticator app code | Better | Can still be phished in real time |
| Push approval | Convenient | Prompt fatigue attacks |
| Hardware security key or passkey | Strong, resists phishing | Cost and recovery planning |
| Biometrics | Convenient | Cannot be changed if leaked, error rates |
Passkeys are based on FIDO2 (Fast Identity Online) and the Web Authentication standard (WebAuthn). The private key stays with the authenticator (the device or a credential manager) and is never sent to the site. The credential is bound to the real site, so a fake login page cannot capture a reusable secret.
Passwordless designs reduce credential theft but need a plan for lost devices.
Biometric systems have two error rates. The false acceptance rate (FAR) is the chance an impostor is accepted, and the false rejection rate (FRR) is the chance a real user is refused. The crossover error rate (CER) is where the two are equal, and a lower CER means a more accurate system.
Federation protocols
| Protocol | Purpose | Format |
|---|---|---|
| Security Assertion Markup Language (SAML) | Authentication for web SSO, common for enterprise apps | Extensible Markup Language (XML) assertions |
| Open Authorization (OAuth) 2.0 | Delegated authorization, letting an app act with limited access | Access tokens |
| OpenID Connect (OIDC) | Authentication layer on top of OAuth 2.0 | ID token, which is a JSON Web Token (JWT) built on JavaScript Object Notation (JSON) |
| Kerberos | Ticket based authentication inside a domain | Tickets |
| Remote Authentication Dial-In User Service (RADIUS) and Terminal Access Controller Access-Control System Plus (TACACS+) | Authentication, authorization and accounting for network access and devices | Network protocols |
The key exam distinction is that OAuth 2.0 handles authorization, not login. OIDC adds identity to it. In a SAML flow the identity provider (IdP) issues the assertion and the service provider (SP) consumes it.
Conditional and risk based access
Conditional access evaluates context at sign in: user, device health, location, network and risk score. The policy then allows, requires stronger MFA, limits access or blocks.
Step up authentication asks for more proof only when a sensitive action occurs. Continuous evaluation can revoke a session when risk changes.
Identity proofing and provisioning
Identity proofing verifies that a person is who they claim before an account is issued, using documents, checks against records, or in person verification. Stronger proofing is needed for privileged and high assurance accounts.
Provisioning creates accounts and entitlements automatically from an authoritative source such as the human resources system. The System for Cross-domain Identity Management (SCIM) is a standard for automated provisioning between an identity provider and applications. Deprovisioning must be as automatic as provisioning, or leavers keep access.
Session and token handling
Short token lifetimes limit stolen token damage. Refresh tokens must be protected and revocable. Bind sessions to devices where possible, and require re authentication for sensitive operations.
Design trade offs
Federation reduces password sprawl, but the identity provider becomes a critical target and a single point of failure, so protect and make it redundant. Cloud identity providers are easy to adopt, but legacy applications may need a gateway or proxy to join SSO.
What to remember for the exam
- MFA needs different factor types, and two passwords are not MFA.
- Phishing resistant methods are hardware keys and passkeys using FIDO2 and WebAuthn.
- SAML is XML based web SSO, OAuth 2.0 is authorization, OIDC adds authentication to OAuth.
- The identity provider authenticates users and the service provider relies on it.
- Conditional access decides using device, location and risk context.
- Biometrics are measured by FAR, FRR and CER.
- SCIM automates provisioning and deprovisioning across systems.
- The identity provider is a high value target and needs protection and redundancy.
If a question says users are tricked into approving login prompts, the fix is number matching or phishing resistant authentication, not more reminders.
Common mistakes
Using OAuth as proof of identity. OAuth grants access to resources. Use OIDC when you need to know who the user is.
Counting SMS as strong. It is better than a password alone, but it can be intercepted or redirected.
Forgetting recovery. Passwordless designs fail badly without a secure way to recover lost devices.
Leaving old accounts. Without automated deprovisioning, former staff keep valid access.
Check yourself
Work through these three questions.
Which protocol adds an authentication layer on top of OAuth 2.0?
OpenID Connect (OIDC).
Why do passkeys resist phishing?
The credential is bound to the genuine site and the private key is never sent to any site, so a fake page gets nothing reusable.
What is the role of the identity provider in federation?
It authenticates the user and issues an assertion or token that the service provider trusts.
Topic 7 of 12 in Security Architecture
Test yourself on Security Architecture
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.