cisco certification specialist

cisco certification specialist.Principal: An end-user who requests a service from a Service Provider and whose identity has been authenticated. Service Provider (SP): sometimes referred to as a Relying Party (RP), which can be defined as a system entity that provides services to a protagonist or other entity within the federation. Identity Provider (IdP): Another type of service provider that manages the authentication and authorization process on behalf of other systems in the federation.5.2 Introduction to Identity and Access Management 243Assertion: Information generated by an authentication device (e.g., IdP). It is typically provided to the SP to allow users to access its resources. The assertion is used to prove that the user is authenticated, and it also contains other user attributes and authorization instructions.Within a federation context, an SP can rely on multiple IdPs, and an IdP can provide services to multiple SPs. When a user wants to access a resource that owns an SP, that SP determines which IdP to use to authenticate the user. The choice of IdP depends on the user identifier or user preference (e.g., the user can specify a specific IdP), or the domain name associated with the user's email address. This process is called discovery of identity. oThen, the SP redirects the user to the IdP, which performs the authentication process. Once the user is authenticated, the IdP generates an assertion proving the user's identity, which contains information about the user and the authorization.An example similar to Figure 5.6 is shown in Figure 5.8. However, the SSO server that authenticates the user belongs to Unit A, while Server B, which the user wants to access, belongs to Unit B. In such a case, the SSO server acts as the IdP and Server B acts as the SP.Figure 5-8 Federation SSOAs in Figure 5.6, the user still sends an access request to Server B (Step 1), which redirects the user to the SSO server for authentication (Steps 2 and 3). Then, the user is authenticated by the SSO server and receives an "identity proof", called an assertion. The user sends the assertion to Server B (Steps 4 and 5). After checking the information contained in the assertion, Server B will grant the user access to the resource.