The city plans to back Wi-Fi identity with a cloud IdP through an AAA proxy. Which architecture statement remains true?
Select an answer to reveal the explanation.
Short Explanation
Cloud IdPs change where passwords live, not the fact that Wi-Fi still speaks EAP through RADIUS-style AAA. The proxy is a translator, not a free pass to open SSIDs. Staff still need proper Enterprise termination.
Full Explanation
When a city’s Wi-Fi identity management leverages a cloud Identity Provider (IdP) through an AAA proxy, the core design still revolves around RADIUS and Extensible Authentication Protocol (EAP) termination patterns. The AAA proxy translates authentication requests between the local network infrastructure and the cloud IdP, maintaining the established RADIUS/EAP framework. This ensures compatibility with existing WLAN hardware and security protocols. Assuming 802.1X and RADIUS termination become optional once a cloud directory exists is incorrect because these protocols provide the essential authentication and authorization mechanisms regardless of where identity data resides. Falling back to open authentication on Access Points (APs) when the IdP is slow compromises security by allowing unauthenticated access. Replacing EAP with captive portals for all staff laptops disregards the advantages of strong, certificate-based authentication and is unsuitable for enterprise-grade security. The key caveat is that cloud IdPs enhance identity management but do not eliminate the need for robust local authentication mechanisms. Operationally, verify that the AAA proxy correctly forwards authentication requests to the cloud IdP and that fallback procedures maintain security without defaulting to open access.