Cloud Authentication Mechanisms (OAuth, SSO) Questions and Answers for Viva

Answer-1: Federated identity allows users to use credentials from one domain (like Google or Facebook) to access resources in another.

Answer-2: OAuth 2.0 is more flexible,supports multiple flows,and uses bearer tokens instead of signing every request.

Answer-3: OAuth can be used for SSO when combined with OpenID Connect to provide identity verification.

Answer-4: An IdP authenticates users and provides identity information to service providers using standards like SAML or OpenID Connect.

Answer-5: A service provider relies on an identity provider to authenticate users and provide identity assertions.

Answer-6: JWT (JSON Web Tokens) are commonly used to represent access or ID tokens in OAuth and OpenID Connect flows.

Answer-7: Improper SSO can lead to unauthorized access,token misuse,or session hijacking.

Answer-8: Store them securely,use HTTPS,set short expiration,and use scopes to limit access.

Answer-9: The redirect URI is where the authorization server sends the user after authentication,often with the token or code.

Answer-10: It is a process where the resource server checks the validity and metadata of an access token.

Answer-11: Yes,SSO can be implemented in on-premise environments but is commonly used in cloud for ease of integration.

Answer-12: Multi-Factor Authentication adds an extra layer of security to the SSO login process.

Answer-13: PKCE (Proof Key for Code Exchange) is a security feature for public clients to mitigate authorization code interception attacks.

Answer-14: Authentication verifies identity; authorization determines access permissions.

Answer-15: Yes,SSO is highly scalable and suited for enterprises with many applications and users.

Answer-16: Session management ensures that users' authenticated sessions are properly maintained and invalidated across services.

Answer-17: The client uses a refresh token to obtain a new access token or the user must re-authenticate.

Answer-18: Logout can be challenging in SSO as it requires coordinating session termination across multiple applications.

Answer-19: Social login uses OAuth/OpenID Connect to let users authenticate via their social media accounts like Google or Facebook.

Answer-20: Delegated authorization allows users to grant applications limited access to their data on another service.

Answer-21: Yes,OAuth 2.0 is widely used in mobile apps,often using PKCE to enhance security.

Answer-22: Identity federation is a system that allows authentication and access across multiple security domains.

Answer-23: Access token is used for resource access; ID token is used to verify identity in OpenID Connect.

Answer-24: Tokens can be revoked via the authorization server?s token revocation endpoint or via application-specific methods.

Answer-25: SSO reduces the number of credentials to manage,streamlines user provisioning,and simplifies access control.

Answer-26: A bearer token is an access token that allows access to resources as long as it is valid and presented by the client.

Answer-27: It provides information about the method used to authenticate a user,often used in SSO for risk-based decisions.

Answer-28: OpenID Connect uses ID tokens and standardized scopes to facilitate SSO by transmitting user identity across apps.

Answer-29: Azure AD provides SSO and federation capabilities for Microsoft and third-party cloud applications.

Answer-30: It?s a Google service that supports OAuth 2.0 and OpenID Connect for authentication in cloud apps.

Answer-31: Auth0,Okta,Azure AD,AWS Cognito,Keycloak,and Ping Identity are popular identity providers.

Answer-32: OAuth can delegate access to apps,while SSO ensures the user authenticates once to access all associated apps.

Answer-33: OAuth (Open Authorization) is an open standard for access delegation,allowing apps to access user information without exposing passwords.

Answer-34: SSO (Single Sign-On) is an authentication process that enables users to access multiple applications with one set of credentials.

Answer-35: OAuth allows users to grant third-party applications limited access to their resources without sharing credentials by using access tokens.

Answer-36: OAuth is primarily an authorization protocol,not designed for authentication.

Answer-37: OpenID Connect is an authentication layer built on top of OAuth 2.0 that enables client applications to verify user identity.

Answer-38: SSO reduces the number of times users have to log in by enabling one login for multiple systems or applications.

Answer-39: The authorization server issues tokens after successfully authenticating and authorizing the user.

Answer-40: Access tokens are credentials used to access protected resources on behalf of the user.

Answer-41: Refresh tokens are used to obtain new access tokens without requiring the user to re-authenticate.

Answer-42: Resource Owner,Client,Resource Server,and Authorization Server.

Answer-43: Yes,SSO can enable seamless login across multiple cloud-based applications.

Answer-44: OAuth is for authorization; SAML is a protocol for both authentication and authorization often used in SSO.

Answer-45: A grant type optimized for client-side applications where tokens are returned directly without intermediate code exchange.

Answer-46: OAuth is secure when implemented correctly using HTTPS,secure token storage,and proper scopes and lifetimes.

Answer-47: It is a two-step process used by server-side applications where the client exchanges an authorization code for an access token.

Answer-48: A scope defines the level of access requested by the client,such as read or write permissions.

Answer-49: SSO can enhance security by reducing password fatigue but requires strong authentication and session management.

Answer-50: Tokens have limited lifetimes to minimize risk if they are compromised; expired tokens must be refreshed or reissued.