Universal Containers (UC) is using a custom application that will act as the Identity Provider and will generate SAML assertions used to log in to Salesforce. UC is considering including custom parameters in the SAML assertion. These attributes contain sensitive data and are needed to authenticate the users. The assertions are submitted to salesforce via a browser form post. The majority of the users will only be able to access Salesforce via UC's corporate network, but a subset of admins and executives would be allowed access from outside the corporate network on their mobile devices. Which two methods should an Architect consider to ensure that the sensitive data cannot be tampered with, nor accessible to anyone while in transit?

Question

Johnny Oostdijk · Accepted Answer

Use the Identity Provider's certificate to digitally sign and Salesforce's Certificate to encrypt the payload.

Johnny Oostdijk · Accepted Answer

Use the Identity provider's certificate to digitally Sign and the Identity provider's certificate to encrypt the payload.

Johnny Oostdijk · Answer

Use Salesforce's Certificate to digitally sign the SAML Assertion and a Mobile Device Management client on the users' mobile devices.

Johnny Oostdijk · Answer

Use a custom login flow to retrieve sensitive data using an Apex callout without including the attributes in the assertion.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 104 - Certified Identity and Access Management Architect discussion

Suggested answer: A, C

0 comments