County applications currently force unique passwords everywhere, while a trusted state identity provider already authenticates the same employees. Which approach applies federated identity management?
Select an answer to reveal the explanation.
Short Explanation
If the state already knows who these employees are, stop inventing a new password island for every county app. Federate to the trusted state IdP and consume its assertions. Nightly password copies, forever-local passwords, or “badge photo equals login” are not federation.
Full Explanation
Federated identity management lets county applications trust authentication performed by a trusted state identity provider instead of forcing a unique local password for every app. Accept federation assertions from that state IdP—after validating signatures, metadata, certificates, and audience—so county apps rely on the established employee identity without storing a new password per application. Attribute mapping then drives local authorization under least privilege. The result reduces password sprawl, improves usability for staff who already authenticate to the state, and concentrates authenticator policy where identity is authoritative.
Duplicating every state password into each county app’s local database nightly recreates credential sprawl, multiplies breach impact, and is not federation—it is password synchronization theater. Blocking all state identities and requiring new county passwords for every app indefinitely rejects the federation opportunity and keeps the password-island problem the scenario describes. Printing state employee badges and treating badge photos as network authentication confuses visual facility identification with cryptographic system authentication and provides no assertion integrity.
Exam caveat: federation consumes validated assertions from a trusted IdP; copying passwords or substituting badges is not federated IAM. Operational check: configure county apps (or a county SP gateway) to accept only the trusted state IdP’s signed assertions, validate metadata and keys on a schedule, stop local per-app password issuance for those users, and map only needed attributes into county authorization decisions.