<< Prev Question Next Question >>

Question 17/122

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO's Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.
What should an identity architect recommend to prevent this from happening in the future?

A. Configure an authentication provider to delegate authentication to the LDAP directory.

B. Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

C. Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

D. use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

Recent Comments (The most recent comments are at the top.)

Ajn - Jul 27, 2024

B - By setting up an identity provider (IdP) for single sign-on (SSO) with LDAP, Salesforce authentication is handled through the IdP, which ensures that any changes (such as disabling a user) in LDAP are directly reflected in Salesforce. Disabling Login Form authentication ensures that users cannot bypass the IdP and log in directly to Salesforce, which helps enforce the security policy consistently.

frsdf - Jun 19, 2024

But for delegation the authentication provider is not necessary.

Question 17/122

Recent Comments (The most recent comments are at the top.)

LEAVE A REPLY

Download PDF File