Question

A financial services company deploys a dozen SaaS applications for its employees and wants to centralize authentication so users log in once with corporate credentials. The security team implements SAML-based federation with the corporate identity provider (IdP) issuing assertions to each SaaS relying party. During a design review, an architect warns that this federation model introduces a specific risk that must be mitigated. Which risk is MOST directly created by this federated SSO design, and what is the appropriate mitigation?

Accepted Answer

The IdP becomes a high-value single point of compromise; mitigate by hardening the IdP with strong MFA, monitoring, and short assertion lifetimes.

Answer

Each SaaS provider must store user passwords locally; mitigate by rotating those passwords frequently across all providers.

Answer

Federation eliminates the ability to enforce authorization, so RBAC cannot be applied; mitigate by disabling SSO for privileged users.

Answer

SAML assertions are transmitted unencrypted by design; mitigate by switching all applications to OAuth client credentials grant.