Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Identity & Access Management > Single Sign On > Flashcards

Single Sign On Flashcards

1
Q

What are the 3 methods to get SSO on SF?

A
  1. Federated Authentication using SAML
  2. Delegated Authentication
  3. Login using credentials from another service - OpenID Connect
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Describe the login flow when SF is the SP?

A
  1. SF sends SAML request to IDP
  2. IDP sends SAML assertions to SF using SAML web single sign on Browser POST
  3. SF receives the assertion, verifies against the org and if true allows SSO
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the configuration steps to configure SF as SP?

A
  1. Create Federation ID for each user
  2. Setup SSO settings in SF (SAML Single Sign On settings - SAML Sign In URL and certificate from IDP needed)
  3. Get Information required from IDP
  4. Configure Pages on SF
  5. Setup SF settings in IDP (SAML ACS URL and entity ID needed on IDP)
  6. Test
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the key fields required in SAML Single Sign On settings / required from IDP?

A
  1. Issuer
  2. Entity ID
  3. Request Signing Certificate
  4. SAML Identity Type
  5. SAML Identity Location
  6. SP Initiated Request Binding
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the different SAML identity types that can be configured in SAML Single Sign On Settings?

A
  1. Salesforce Username
  2. Federation ID
  3. User ID
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the SAML Identity Locations that are supported in SAML Single Sign On Settings?

A
  1. NameIdentifier of Subject statement

2. Attribute element

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What further information do you need if the SAML Identity Location is Attribute?

A
  1. Attribute Name
  2. Attribute URI
  3. Name ID format
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the 2 types of request binding supported for SP initiated requests?

A
  1. HTTP POST

2. HTTP Redirect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the SSO pages that can be configured?

A
  1. Start
  2. Login
  3. Logout
  4. Error
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the sequence for SSO determining what pages to use?

A
  1. Session cookie
  2. Values passed from IDP
  3. Values specified on Single Sign On page
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the page values passed from IDP?

A
  1. ssoStartPage - where does SSO flow start / login URL
  2. Use RelayState - control where users are redirected after login
  3. startURL - where users go after sso
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are 2 ways of performing JIT?

A
  1. Standard (provision automatically based on values in the assertion)
  2. Custom (based on logic in the handler class)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In what SAML tag are JIT fields passed?

A

SAML Attribute e.g.

  testuser@123.org
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What do fields need to be prefixed with for JIT?

A

User.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can you define Profile for JIT?

A

Pass ProfileName in ProfileID field

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are required fields for JIT?

A

Email
Lastname
ProfileID
Username (insert only)

17
Q

When can you pass Federation ID for JIT?

A

On Insert Only mode

18
Q

What are the steps required when you set up SF as an IDP?

A
  1. Enable SF as IDP
  2. Determine which certificate you will use
  3. Exchange SSO information with SP
  4. Create SAML Connected App
  5. Map SF Users to SAML SP
19
Q

What information needs to be obtained from the SP if SF is the IDP?

A
  1. Certificate
  2. Assertion Consumer Service (ACS)
  3. Entity ID
  4. Subject Type
  5. Security Certificate
20
Q

What are the Identity Provider Chains that are supported with the SF platform?

A
  1. SAML Only
  2. OpenID Connect Only
  3. SAML & OpenID
21
Q

Where are SSO permissions controlled for Delegated Authentication?

A

User Level

22
Q

Describe the login flow for Delegated Authentication

A
  1. User has SSO enabled on user record
  2. SF does not validate username or password
  3. Calls webservice
  4. When response is True
  5. New session is generated
  6. User gets access
23
Q

Describe the setup process for Delegated Authentication

A
  1. Enable Delegated Authentication in Setup - Single Sign On Settings - Disable Login with Salesforce Credentials
  2. Build web service
  3. Specify Delegated Authentication Gateway URL (Single Sign On settings)
  4. Enable User permissions - ‘Is Single Sign-On Enabled’
24
Q

What are security measures you should consider with the authentication service used in Delegated Authentication?

A
  1. DMZ

2. 3rd Party CA used for TLS

25
Q

What happens if a user resets their SF password while using Delegated Authentication?

A

They get redirected to their SF admin

26
Q

How do you troubleshoot errors with Delegated Authentication?

A

Setup - Delegated Authentication Error History

27
Q

What are the requirements to set up SP initiated SSO?

A
  1. SAML sign in URL (Issuer) and certificate from IDP to be configured in SP
  2. SAML ACS URL and entity ID from SP to be configured in IDP (both in Connected App)
28
Q

What is RelayState used for in a SAML SSO flow?

A

Persisting the state of the original requested URL to support use cases such as deep linking

29
Q

What are some extra security features that can be used for SP initiated SSO?

A
  1. Request signing and verification
  2. Assertion encryption
  3. Session level controls - e.g. MFA
30
Q

What are the certificates that can be used in SSO?

A
  1. IDP certificate to be loaded in SP
  2. Request signing certificate from SP (and signature method)
  3. Assertion decryption certificate loaded on SP

Identity & Access Management (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions