Cloud Application Security · Topic 6 of 6
Identity and Access Management Solutions
CCSP cloud IAM: federated identity with SAML, OAuth and OIDC, identity providers, SSO, MFA, CASB modes, and secrets, key and certificate management.
- 5 min
- IdP authenticates; service provider trusts the IdP's signed assertion or token.
- SAML uses XML assertions; OAuth 2.0 authorizes; OIDC authenticates on top of OAuth.
- SCIM automates provisioning and deprovisioning.
What it is
Identity is the main security boundary in the cloud. Users reach applications from anywhere, and services call each other across networks, so access decisions depend on who or what is asking rather than where they are.
An IAM solution brings together federated identity, identity providers, single sign-on, multi-factor authentication, a cloud access security broker for SaaS visibility, and management of the secrets, keys and certificates that applications use.
How it works
Federated identity
Federation lets one organization's identities be trusted by another's applications. The identity provider (IdP) authenticates the user; the service provider (SP), also called the relying party, trusts the IdP's signed statement.
| Standard | Purpose | Format |
|---|---|---|
| SAML 2.0 | Authentication and attribute exchange, common for enterprise web SSO | XML assertions |
| OAuth 2.0 | Delegated authorization: an application gets an access token to act for a user | Access tokens |
| OpenID Connect (OIDC) | Authentication layer on top of OAuth 2.0 | JSON Web Token ID tokens |
| WS-Federation | Federation in WS-* environments | XML tokens |
| SCIM | Provisioning and deprovisioning user accounts across services | JSON over REST |
OAuth 2.0 alone is for authorization, not authentication; use OIDC when the application needs to know who the user is.
Federation models include hub and spoke, where a central broker connects many parties, and mesh or trust between each pair of parties.
Identity providers
An IdP holds identities and authenticates them. It can be the organization's own directory exposed through federation, a cloud identity service, or a social or partner IdP. Choosing the IdP means deciding who controls identities, how joiners, movers and leavers are handled, and where authentication logs live.
When an employee leaves, disabling the account at the IdP removes access to every federated application at once, which is a major security benefit.
Single sign-on
SSO lets a user authenticate once and reach many applications. Benefits: fewer passwords, central policy, central logging and fast deprovisioning. The risk is concentration: a compromised SSO session or IdP opens every connected application, so the IdP needs the strongest protection and MFA.
Multi-factor authentication
MFA combines factors from different categories: something you know, something you have, something you are. Two passwords are not MFA.
| Method | Strength |
|---|---|
| SMS one time codes | Weakest; exposed to SIM swap and interception |
| Authenticator app codes | Better; still phishable |
| Push approval | Convenient; vulnerable to fatigue attacks without number matching |
| FIDO2 security keys and passkeys | Phishing resistant; bound to the genuine site |
Administrators and other privileged users should use phishing resistant MFA.
Cloud access security broker
A CASB sits between users and cloud services to give visibility and enforce policy, especially for SaaS.
| Mode | How it works | Strength |
|---|---|---|
| API based | Connects to SaaS APIs to scan data and settings out of band | Sees data at rest and configuration; no traffic path changes |
| Forward proxy | Traffic from managed devices passes through the CASB | Inline control, including for unsanctioned apps |
| Reverse proxy | The SaaS login redirects sessions through the CASB | Inline control without device agents |
CASB functions are often summarized as visibility (including shadow IT discovery), compliance, data security (DLP, encryption) and threat protection (unusual behaviour, compromised accounts).
Secrets, key and certificate management
Applications need credentials to reach databases, APIs and other services.
- Use workload identities and short lived tokens instead of static keys where the platform supports them.
- Store unavoidable secrets in a secrets manager, retrieved at run time and rotated automatically.
- Manage encryption keys in a KMS or HSM with separate permissions for key administration and use.
- Keep a certificate inventory, automate renewal, monitor expiry and revoke compromised certificates.
A worked example
A company uses twenty SaaS applications, each with its own passwords. Departing employees keep access for weeks, and staff upload files to unapproved file sharing services.
The architect connects all sanctioned applications to one IdP through SAML or OIDC with SSO and FIDO2 MFA, and uses SCIM so disabling a user at the IdP removes all accounts. A CASB in API mode scans sanctioned SaaS for public shares, and forward proxy mode on managed devices discovers and controls unsanctioned services.
How the exam asks about this
- "Which standard adds authentication to OAuth 2.0?" OpenID Connect.
- "Which control gives visibility of unsanctioned SaaS use by employees?" A CASB, using proxy or log based discovery.
- "What is the MAIN risk introduced by single sign-on?" Compromise of the IdP or an SSO session exposes every connected application.
What to remember for the exam
- IdP authenticates; service provider trusts the IdP's signed assertion or token.
- SAML uses XML assertions; OAuth 2.0 authorizes; OIDC authenticates on top of OAuth.
- SCIM automates provisioning and deprovisioning.
- Phishing resistant MFA (FIDO2) for administrators; SMS is the weakest option.
- CASB modes: API based, forward proxy, reverse proxy.
Using OAuth 2.0 access tokens as proof of who a user is leads to impersonation flaws. Authentication needs an ID token from OpenID Connect or a SAML assertion.
Common mistakes
Calling two passwords MFA. Both are something you know; MFA needs different factor categories.
Protecting applications but not the IdP. The IdP is the key to every federated service.
Expecting an API mode CASB to block uploads in real time. API mode works out of band; inline blocking needs a proxy mode.
Check yourself
What does SCIM do?
It automates creating, updating and removing user accounts across cloud services, so deprovisioning at the IdP reaches every application.
What is the difference between a forward and a reverse proxy CASB?
A forward proxy inspects traffic from managed devices to any cloud service, while a reverse proxy sits in front of specific cloud applications and needs no agent on the device.
Why is FIDO2 called phishing resistant?
Its credential is bound to the genuine site's origin, so it will not authenticate to a lookalike phishing site.
Topic 6 of 6 in Cloud Application Security
Test yourself on Cloud Application Security
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.