Practise the IT-English vocabulary of configuring SSO: identity provider, service provider, SAML assertions, metadata and just-in-time provisioning.
0 / 15 completed
1 / 15
In SSO, what is the 'identity provider' (IdP)?
The IdP authenticates the user and issues assertions; the app (service provider) trusts those assertions.
2 / 15
A colleague says: 'Send me your SP metadata so I can configure the connection.' What is the 'service provider'?
The service provider (SP) is the application consuming the SSO; it trusts the IdP for authentication.
3 / 15
A SAML 'assertion' carries what?
A SAML assertion is a signed token conveying who the user is and their attributes to the SP.
4 / 15
'Just-in-time (JIT) provisioning' does what on first login?
JIT provisioning creates the local account on first SSO login using the attributes the IdP provides.
5 / 15
Which sentence correctly uses 'metadata' in SSO setup?
SSO metadata describes endpoints and signing certificates, letting IdP and SP trust each other.
6 / 15
During a Slack conversation with the security team regarding our new SSO implementation, Alex says: 'We need to ensure that all users are authenticated against Azure AD. Can you provide me with the details of the SAML response we'll be sending back?' What is Alex *primarily* asking for?
Alex is requesting the SAML assertion – this XML document is crucial for SSO. It contains the user's identity (username, email) and any relevant attributes (groups, roles) that the service provider (our app) needs to use for authorization. He's not asking for a user list or security policies; those are separate concerns.
7 / 15
Review this PR description: 'Implemented SSO using Auth0. The application now redirects to Auth0 for login, and upon successful authentication, it receives a JWT token which is then used to access protected resources.' What is the most important piece of information missing from this description that would be helpful for another developer?
While the description mentions JWT tokens and redirects, it lacks crucial details about *which* API endpoints are secured by those tokens. This is essential for understanding the scope of the SSO implementation and how to properly utilize the token. The client ID/secret configuration is also vital for proper integration.
8 / 15
During a standup meeting, Sarah mentions: 'We've configured SSO using Okta. Users are now automatically provisioned with access to our internal applications based on their roles defined in Okta.' What does 'automatic provisioning' refer to in this context?
Automatic provisioning, in the context of SSO with Okta, describes the automated assignment of users and their associated roles within the application based on the information received from the identity provider (Okta) during the initial login. This eliminates manual user management and streamlines onboarding.
9 / 15
You're troubleshooting an SSO issue where users are intermittently unable to log in after a recent update to our application's authentication flow. The logs show that the service provider (your app) is sending a valid SAML assertion to the identity provider (Google). However, Google isn't successfully validating the assertion. What initial step should you take to diagnose this problem?
The core problem is likely a mismatch between the attributes defined in your application's SAML request and those expected by Google's Identity Platform. Requesting and comparing the metadata document will reveal the specific attribute names and formats that Google requires. This allows you to pinpoint any configuration errors in your app.
10 / 15
Which of the following statements best describes the role of 'metadata' in an SSO setup?
Metadata in SSO acts as a digital handshake between the service provider (your application) and the identity provider (e.g., Azure AD). It contains crucial information like URLs, certificates, and attribute definitions necessary for establishing a secure and trusted connection. It's not a password or encryption key.
11 / 15
During a Slack conversation with the security team regarding our new SSO implementation, Alex says: 'We need to ensure that all users are authenticated against Azure AD. Can you provide me with the details of the SAML response we'll be sending back?' What is Alex *primarily* asking for?
Alex is requesting the SAML assertion – this XML document is crucial for SSO. It contains the user's identity (username, email) and any relevant attributes (groups, roles) that the service provider (our app) needs to use for authorization. He's not asking for a user list or security policies; those are separate concerns.
12 / 15
Review this PR description: 'Implemented SSO using Auth0. The application now redirects to Auth0 for login, and upon successful authentication, it receives a JWT token which is then used to access protected resources.' What is the most important piece of information missing from this description that would be helpful for another developer?
While the description mentions JWT tokens and redirects, it lacks crucial details about *which* API endpoints are secured by those tokens. This is essential for understanding the scope of the SSO implementation and how to properly utilize the token. The client ID/secret configuration is also vital for proper integration.
13 / 15
During a standup meeting, Sarah mentions: 'We've configured SSO using Okta. Users are now automatically provisioned with access to our internal applications based on their roles defined in Okta.' What does 'automatic provisioning' refer to in this context?
Automatic provisioning, in the context of SSO with Okta, describes the automated assignment of users and their associated roles within the application based on the information received from the identity provider (Okta) during the initial login. This eliminates manual user management and streamlines onboarding.
14 / 15
You're troubleshooting an SSO issue where users are intermittently unable to log in after a recent update to our application's authentication flow. The logs show that the service provider (your app) is sending a valid SAML assertion to the identity provider (Google). However, Google isn't successfully validating the assertion. What initial step should you take to diagnose this problem?
The core problem is likely a mismatch between the attributes defined in your application's SAML request and those expected by Google's Identity Platform. Requesting and comparing the metadata document will reveal the specific attribute names and formats that Google requires. This allows you to pinpoint any configuration errors in your app.
15 / 15
Which of the following statements best describes the role of 'metadata' in an SSO setup?
Metadata in SSO acts as a digital handshake between the service provider (your application) and the identity provider (e.g., Azure AD). It contains crucial information like URLs, certificates, and attribute definitions necessary for establishing a secure and trusted connection. It's not a password or encryption key.
What will I practise in "SSO Setup Conversations"?
Practise the IT-English vocabulary of configuring SSO: identity provider, service provider, SAML assertions, metadata and just-in-time provisioning.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.