Federated Identity — CISSP Study Guide

Bundled into the existing Certified Information Systems Security Professional premium course — no separate purchase.

Included in this chapter:

Aspect	On-premises federation	Cloud IDaaS	Hybrid
Where the IdP runs	Federation server inside the corporate perimeter	Provider-hosted IdP consumed as a service	Cloud IdP synchronized from / fronting an on-prem directory
Authoritative directory	On-premises and under full org control	In the provider's tenant	On-premises remains the source of truth
Operational burden	Org runs and patches the federation infrastructure	Provider runs it; org configures trust and policy	Split: org runs the directory, provider runs federation
Added third party in the trust chain	None beyond the partner RP	The IDaaS provider must also be trusted	The IDaaS provider, but the directory stays in-house
Best fit	Strict data-residency or full-control mandates	SaaS-first organizations with limited identity staff	Established directory adopting SaaS gradually

Cheat sheet

Federation lets an RP accept the authentication a separate organization's IdP performs
Identity provider asserts, relying party consumes: the two federation roles
Federation is SSO across an organizational boundary; plain SSO stays in one domain
The RP must validate the assertion signature against the IdP's pre-registered key
Audience restriction stops an assertion for one RP being replayed at another
Release only the attributes each RP needs: minimize what the IdP shares
On-premises, cloud IDaaS, and hybrid are deployment choices, not different trust models
On-premises federation keeps the IdP and directory inside the perimeter
Cloud IDaaS outsources the IdP but adds a third party to the trust chain
Hybrid keeps the on-prem directory authoritative while a cloud IdP brokers federation
Federating concentrates risk in the IdP: its compromise impersonates everyone everywhere
The IdP's concentration is also the benefit: one place to deprovision everywhere
Protect the IdP signing key in hardware and rotate it
A federation contract does not substitute for technically verifying and monitoring the IdP
A federated assertion proves earlier authentication, not present authentication
NIST SP 800-63C grades assertion protection as a Federation Assurance Level (FAL)
Don't federate when there is no boundary or no trustworthy IdP
OIDC ID-token validation: verify signature, audience, issuer, and nonce
Federated ABAC requires mapping partner attribute schemas to a common meaning

Unlock with Premium — includes all practice exams and the complete study guide.