In a SAML 2.0 web single sign-on flow between an enterprise identity provider and a SaaS application, which party issues the signed assertion that states who the user is, and which party consumes it to grant access?
- AThe identity provider issues the signed assertion, and the service provider consumes it to grant access. Correct
- BThe service provider issues the signed assertion, and the identity provider consumes it to grant access.
- CThe user agent issues the signed assertion, and the identity provider consumes it to grant access.
- DA cloud access security broker issues the signed assertion, and the service provider consumes it to grant access.
Why A is correct: In SAML the identity provider authenticates the user and issues a digitally signed assertion; the service provider (the relying SaaS application) validates that assertion and grants access, which is the correct division of roles.
Why B is wrong: This reverses the two roles, a common confusion; the service provider never issues the assertion, it only trusts and validates one produced by the identity provider.
Why C is wrong: The browser only relays messages between the parties; it cannot sign an assertion because it does not hold the identity provider signing key, so this is wrong.
Why D is wrong: A CASB enforces policy and gives visibility over cloud use, but it is not the SAML authority that mints assertions, so naming it as the issuer is incorrect.