Identity and Access Management (IAM) · Topic 2 of 4
Federation and Authentication Systems
Federated identity with SAML, OAuth 2.0 and OpenID Connect, cloud and hybrid identity, and authentication systems such as Kerberos, RADIUS and TACACS+.
- 3 min
- Includes a diagram
- IdP authenticates; SP or relying party trusts it.
- SAML uses XML assertions; OAuth 2.0 is authorization; OIDC adds authentication.
- Know the OAuth authorization code flow order.
What it is
Federated identity lets users sign in with one organization's identity and use another organization's service, without separate accounts. Authentication systems are the protocols and services that carry out authentication inside and across organizations.
How it works
Federation roles
| Role | Meaning |
|---|---|
| Identity provider (IdP) | Authenticates the user and issues assertions or tokens |
| Service provider (SP) / relying party | Trusts the IdP and grants access |
| User / principal | The person signing in |
Deployment models: on-premises identity providers, cloud identity services, and hybrid setups that synchronize or federate between them.
Federation and authorization protocols
| Protocol | Purpose | Notes |
|---|---|---|
| SAML 2.0 | Authentication and attribute exchange using XML assertions | Common for enterprise web SSO |
| OAuth 2.0 | Authorization: lets an application access resources on a user's behalf with access tokens | Not an authentication protocol by itself |
| OpenID Connect (OIDC) | Authentication layer on top of OAuth 2.0, issuing ID tokens | Common for modern web and mobile apps |
OAuth answers "what may this app do on my behalf?"; OIDC answers "who is this user?". SAML does authentication and attribute exchange with XML assertions.
OAuth 2.0 authorization code flow
- The client redirects the user to the authorization server.
- The user authenticates and approves the requested scopes.
- The client exchanges the returned authorization code for an access token.
- The client calls the resource server with the access token.
Governing federation
Each new federated application should go through security review: what attributes (claims) are released, how the provider protects data, and approved claim templates. Unreviewed connections created by business units leak data and widen the attack surface.
Authentication systems
| System | Key facts |
|---|---|
| Kerberos | Ticket-based SSO using a Key Distribution Center (Authentication Service and Ticket Granting Service). Users receive a ticket-granting ticket, then service tickets. Uses symmetric cryptography and needs synchronized clocks. The KDC is a single point of failure and a high-value target |
| RADIUS | Network access authentication; UDP; encrypts only the password |
| TACACS+ | Device administration; TCP; encrypts the full payload; separates authentication, authorization and accounting |
| LDAP / directory services | Store identities and attributes; secure with LDAPS |
| Certificates / PKI | Smart card and device authentication |
Accounts in cloud and hybrid identity
Synchronize identities from a master source (for example HR feeding the directory), federate to cloud services, and enforce MFA and conditional access centrally. Remove access centrally so leavers lose all federated access at once.
How the exam asks about this
- "Which protocol adds authentication to OAuth 2.0?" OpenID Connect.
- "Kerberos authentication fails across the network after a clock change." Kerberos relies on time synchronization.
- "Business units connected SaaS apps to the IdP on their own." Require security review and approved claim templates before federation.
What to remember for the exam
- IdP authenticates; SP or relying party trusts it.
- SAML uses XML assertions; OAuth 2.0 is authorization; OIDC adds authentication.
- Know the OAuth authorization code flow order.
- Kerberos: KDC, TGT, service tickets, symmetric keys, time sync.
- RADIUS (UDP, password only encrypted) versus TACACS+ (TCP, all encrypted).
Using OAuth 2.0 alone as proof of a user's identity is a design flaw. Use OpenID Connect for authentication.
Common mistakes
Calling OAuth an authentication protocol.
Forgetting time synchronization for Kerberos.
Letting federation grow without review of what each application receives.
Check yourself
What does an identity provider do in federation?
Authenticates the user and issues assertions or tokens that service providers trust.
What is the purpose of a Kerberos ticket-granting ticket?
It lets the user request service tickets without re-entering credentials.
Which protocol is designed for delegated authorization?
OAuth 2.0.
Topic 2 of 4 in Identity and Access Management (IAM)
Test yourself on Identity and Access Management (IAM)
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.