Practise vocabulary for Single Sign-On and identity federation: SAML, IdP/SP relationships, SCIM provisioning, and enterprise SSO patterns.
0 / 15 completed
1 / 15
In SAML 2.0, the system that authenticates the user and issues identity assertions is called the ___.
The Identity Provider (IdP) authenticates users and issues SAML assertions. Examples include Okta, Azure AD, and Google Workspace configured as SAML IdPs.
2 / 15
In SSO, the application or service that relies on the IdP for authentication is called the ___.
The Service Provider (SP) is the application the user wants to access. It delegates authentication to the IdP and trusts the IdP's assertions.
3 / 15
___ is an open standard for automating user provisioning and deprovisioning between an IdP and service providers.
SCIM (System for Cross-domain Identity Management) automates provisioning — when a user is created in the IdP directory, SCIM automatically creates their account in connected applications.
4 / 15
Just-In-Time (JIT) provisioning means that a user account is ___.
JIT provisioning creates the user account in the Service Provider automatically the first time the user logs in via SSO, using attributes from the SAML assertion.
5 / 15
A SAML ___ is the XML document issued by the IdP that contains the user's identity and authentication information.
A SAML Assertion is the XML document containing authentication statements, attribute statements, and authorization statements that the IdP sends to the SP.
6 / 15
Reviewer: 'I'm seeing a potential issue with the user flow. The application is attempting to directly authenticate against our Azure AD tenant without first going through the SSO gateway. This could lead to inconsistent session management and difficulties with federated identity claims.' What does this reviewer most likely mean in the context of SSO?
The reviewer highlights a critical misconfiguration – bypassing the SSO gateway. This introduces potential inconsistencies in session management and can break federated identity claims that rely on the IdP's established trust. The core concept here is that SSO relies on a *trusted* path through the Identity Provider to manage user authentication and authorization, which direct authentication circumvents.
7 / 15
DevOps Engineer (Sarah): 'Okay team, we've just integrated our new microservice with the corporate identity provider. Users should now be able to log in using their existing credentials via SSO. However, I'm seeing reports of some users not being able to access it – specifically those who haven't been explicitly provisioned within Active Directory. It seems like we need to investigate if our federation configuration is properly propagating user attributes.' What is Sarah referring to when she mentions 'federation configuration' in this context?
Sarah is discussing the critical link between her microservice and the IdP. 'Federation configuration' describes how the trust relationship – established through standards like SAML or OAuth – is set up so that the microservice can authenticate users using credentials managed by the IdP. It's about securely exchanging identity information, not the application code itself.
8 / 15
Pull Request Description: 'Implemented changes to support federated login using OAuth 2.0. The service now redirects users to our Identity Provider (Okta) for authentication and then receives an access token upon successful login. This allows users to seamlessly log in without creating new accounts.' What is the primary benefit of utilizing an 'access token' in this scenario?
An 'access token' is fundamentally about *delegated authorization*. It's a short-lived credential issued by the Identity Provider (Okta) that allows the microservice to access specific resources on behalf of the authenticated user. The IdP controls what those permissions are – this contrasts with a long-lived key, which would grant broader and potentially less secure access.
9 / 15
Developer (Mark): 'Yesterday, we deployed the updated user authentication module. Now, when a new employee joins the company, their account is automatically provisioned through our IdP in real-time via a scheduled task. This JIT provisioning eliminates manual intervention and reduces onboarding time.' What does Mark mean by 'JIT provisioning'?
'JIT' stands for 'Just In Time'. Mark is describing the automated process of creating user accounts *immediately* when triggered by an event (like a new employee joining), rather than being done on a pre-defined schedule. This contrasts with batch provisioning – where accounts are created in bulk at specific intervals.
10 / 15
API Response (from Identity Provider): '{
"status": "success",
"entityId": "urn:oasis:names:tc:SAML:2.0:attributesClaims-initiated",
"nameIDFormat": "unspecified",
"issuer": "https://idp.example.com",
"subject": {
"firstName": "John",
"lastName": "Doe"
}}
' What does the 'nameID' field in this response represent?
The 'nameID' field is a crucial element in SAML assertions. It's a *unique* identifier for the user within the context of the IdP – it's how the IdP knows which specific user account this assertion represents. It's typically used to correlate the assertion with the user's principal in the application.
11 / 15
Reviewer: 'I'm seeing a potential issue with the user flow. The application is attempting to directly authenticate against our Azure AD tenant without first going through the SSO gateway. This could lead to inconsistent session management and difficulties with federated identity claims.' What does this reviewer most likely mean in the context of SSO?
The reviewer highlights a critical misconfiguration – bypassing the SSO gateway. This introduces potential inconsistencies in session management and can break federated identity claims that rely on the IdP's established trust. The core concept here is that SSO relies on a *trusted* path through the Identity Provider to manage user authentication and authorization, which direct authentication circumvents.
12 / 15
DevOps Engineer (Sarah): 'Okay team, we've just integrated our new microservice with the corporate identity provider. Users should now be able to log in using their existing credentials via SSO. However, I'm seeing reports of some users not being able to access it – specifically those who haven't been explicitly provisioned within Active Directory. It seems like we need to investigate if our federation configuration is properly propagating user attributes.' What is Sarah referring to when she mentions 'federation configuration' in this context?
Sarah is discussing the critical link between her microservice and the IdP. 'Federation configuration' describes how the trust relationship – established through standards like SAML or OAuth – is set up so that the microservice can authenticate users using credentials managed by the IdP. It's about securely exchanging identity information, not the application code itself.
13 / 15
Pull Request Description: 'Implemented changes to support federated login using OAuth 2.0. The service now redirects users to our Identity Provider (Okta) for authentication and then receives an access token upon successful login. This allows users to seamlessly log in without creating new accounts.' What is the primary benefit of utilizing an 'access token' in this scenario?
An 'access token' is fundamentally about *delegated authorization*. It's a short-lived credential issued by the Identity Provider (Okta) that allows the microservice to access specific resources on behalf of the authenticated user. The IdP controls what those permissions are – this contrasts with a long-lived key, which would grant broader and potentially less secure access.
14 / 15
Developer (Mark): 'Yesterday, we deployed the updated user authentication module. Now, when a new employee joins the company, their account is automatically provisioned through our IdP in real-time via a scheduled task. This JIT provisioning eliminates manual intervention and reduces onboarding time.' What does Mark mean by 'JIT provisioning'?
'JIT' stands for 'Just In Time'. Mark is describing the automated process of creating user accounts *immediately* when triggered by an event (like a new employee joining), rather than being done on a pre-defined schedule. This contrasts with batch provisioning – where accounts are created in bulk at specific intervals.
15 / 15
API Response (from Identity Provider): '{
"status": "success",
"entityId": "urn:oasis:names:tc:SAML:2.0:attributesClaims-initiated",
"nameIDFormat": "unspecified",
"issuer": "https://idp.example.com",
"subject": {
"firstName": "John",
"lastName": "Doe"
}}
' What does the 'nameID' field in this response represent?
The 'nameID' field is a crucial element in SAML assertions. It's a *unique* identifier for the user within the context of the IdP – it's how the IdP knows which specific user account this assertion represents. It's typically used to correlate the assertion with the user's principal in the application.
What will I practise in "SSO & Identity Federation Language"?
Practise vocabulary for Single Sign-On and identity federation: SAML, IdP/SP relationships, SCIM provisioning, and enterprise SSO patterns.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.