MySmartCoPilot
Ask Passes Your pass 7 days left 1 day left Last day

Your country

Tools that support it use your country for local currency, number formats, units and paper size. Your choice is saved only in this browser.

Web Security (OWASP Top 10:2025) Module 13

Enterprise SSO and provisioning (SAML 2.0 and SCIM 2.0) interview questions

Interview questions on enterprise SSO and provisioning (SAML 2.0 and SCIM 2.0): warm-ups, then what each harder question tests and how a good answer starts.

18 questions: 3 warm-ups and 15 with model answers · Levels: Fresher to staff

Warm-up questions

Short questions with short answers, each answered in full.

  1. Fresher to mid

    What is the difference between a SAML sign-in that the app starts and one that the identity provider starts, and why do many teams leave the second off?

    In a sign-in that the app starts, it saves a new AuthnRequest ID, redirects the browser to the identity provider and expects a response whose InResponseTo equals that ID. In one that the identity provider starts, it posts an unsolicited response, for instance from a tile in its portal, so there is no request to match and InResponseTo is absent. Without the match nothing ties the response to the browser that posts it, which allows login CSRF, and protection against replay rests on the memory of assertion IDs alone. OWASP calls the flow less secure by design and says to enable it only when required. The usual compromise leaves unsolicited responses off and answers a portal tile with a link to the app's own start address, so that the app makes the request.

    From the lesson SAML 2.0 SSO flows, bindings and metadata

  2. Fresher to mid

    What does RelayState carry in a SAML sign-in, and why should it never hold the address to return to?

    Answered in the lesson SAML 2.0 SSO flows, bindings and metadata

  3. Fresher to mid

    Which binding carries the request and which the response in a normal SAML browser sign-in, and why are they not the same?

    Answered in the lesson SAML 2.0 SSO flows, bindings and metadata

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

  1. Mid to senior

    Your SAML service provider verifies the signature of each response and then signs the person in. A colleague signs in to your app with an assertion that the identity provider issued for the company's wiki. Which checks are missing, and how would you test that they now hold?

    What it tests
    Knowing what a signature does not prove, naming the checks that bind an assertion to this app and this sign-in, and turning each into a fixture.
    First step
    Write down what the signature proves, who made the bytes, and what it leaves open: whom the assertion is for, for when and for which request. Then list the field that answers each: Audience, Recipient and Destination, the time window and InResponseTo.
    Follow-ups

    From the lesson SAML 2.0 SSO flows, bindings and metadata

    Opening the model answers with your pass…

    Model answers open with any MySmartCoPilot pass.

    • Pro pass · 1 week₹79$2.99
    • 30 days₹179$5.99
    • 1 year₹1,699$45

    One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.

    Choose a passI have a licence key

    It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

  2. Mid to staff

    You run the SAML sign-in of a product on twelve instances behind a load balancer. Design the memory of used assertion IDs: where it lives, how long each ID stays, what it costs at 50 sign-ins a second, and what happens when the store is down.

    What it tests
    Sizing a replay memory from the validity window and the skew, choosing an atomic shared store, and deciding what to do when it fails.
    First step
    Start from the window: an ID matters until the assertion's NotOnOrAfter plus the allowed skew. Multiply that by the sign-in rate for the size, then choose a store that all twelve instances share, with one write that fails when the ID exists.
    Follow-ups

    From the lesson SAML 2.0 SSO flows, bindings and metadata

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

  3. Mid to senior

    A pull request adds SAML sign-in. It calls the library's verify function, ignores what it returns, and then reads the NameID with an XPath on the original request body. What is wrong, how do you show it with a test, and what do you ask the author to change?

    What it tests
    Recognising signature wrapping in code, writing a failing fixture, and asking for a consumer that reads only the verified element and refuses ambiguous documents.
    First step
    Say what the verify call proves and what it does not: it proves that the element named by the signature's Reference is unchanged, not that the NameID the code reads is inside it. Then picture the same signed element moved elsewhere, with another assertion where the code looks.
    Follow-ups

    From the lesson SAML signature wrapping and XML signature defences

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

  4. Senior to staff

    An advisory says that the SAML library you use accepted responses with two Assertion elements before a fixed version. You are two versions behind. What do you do in the first hour, in the first week, and what changes so that the next advisory is cheaper?

    What it tests
    Responding to a library advisory: scoping the exposure, closing it with a stopgap, upgrading with fixtures, looking for earlier abuse, and making patching routine.
    First step
    Establish whether you are affected: the version in production, whether the vulnerable path is on, and which connections could reach it. Then close the exposure at once with something that does not wait for the upgrade, such as a gate that refuses documents with more than one Assertion.
    Follow-ups

    From the lesson SAML signature wrapping and XML signature defences

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 3 minutes

  5. Mid to senior

    Sign-ins for one customer fail every year or two, when the customer replaces the signing certificate of their identity provider and a support engineer pastes the new certificate in by hand. Redesign the key handling so that a replacement causes no outage and never trusts an unknown key.

    What it tests
    Designing key rollover for a federated connection: metadata as the source, an overlap of two keys, alerts, and refusal of any key that was not published.
    First step
    Replace the pasted certificate with a trust record built from the customer's metadata, fetched from a fixed address, checked for its signature or the fetch's certificate, and refreshed on a schedule. Allow two signing keys at once and refuse every key that was never listed.
    Follow-ups

    From the lesson SAML signature wrapping and XML signature defences

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 3 minutes

  6. Mid to senior

    A multi-tenant app signs people in through each customer's identity provider and finds the account by e-mail address. A customer reports that one of their employees sees another company's data after signing in. What happened, how do you confirm it, and what is the fix?

    What it tests
    Seeing account takeover through e-mail matching across tenants, confirming it from the sign-in records and a fixture, and finding accounts by tenant, issuer and subject.
    First step
    Ask which account the employee landed in and how it was found. If the lookup is by address, a person whose provider asserts an address that another tenant's account holds is signed in to that account. Compare the connection used with the tenant of the account in the sign-in records.
    Follow-ups

    From the lesson Multi-tenant SSO and account linking

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 3 minutes

  7. Senior to staff

    A customer asks you to require single sign-on for everyone. List the ways someone can still get in after you hide the password form, say how you close each, and say how you stop the customer's administrators from locking themselves out.

    What it tests
    Listing every route that creates or continues a session, closing each one, and keeping a documented break-glass route that is alerted and tested.
    First step
    Write down every route that starts or continues a session for a user: password, reset, magic link, invitations, API keys, the refresh of an old session and other sign-in providers. Mark which go through the provider. The rest are the side doors.
    Follow-ups

    From the lesson Multi-tenant SSO and account linking

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 3 minutes

  8. Mid to senior

    After a release that maps identity provider groups to roles by name, a customer finds an intern with the admin role. How did it happen, what do you change, and how do people who move team or leave fit in?

    What it tests
    Explaining role escalation through strings the directory controls, designing a tenant-owned table by group ID, and recomputing roles at each sign-in.
    First step
    Find the intern's groups in the sign-in record and the rule that mapped them. If the rule matches names, anyone who may create a group can name one admins. Replace names with a table of group IDs that the customer's administrator owns, and deny by default.
    Follow-ups

    From the lesson Multi-tenant SSO and account linking

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 3 minutes

  9. Mid to senior

    Your SCIM service has routes of the form /scim/v2/{tenantId}/Users/{id}, and the handler loads a user by its ID. A security review says that one customer's token can read another customer's users. Explain the cause, fix it, and say how you would learn whether it was used and how you would stop it coming back.

    What it tests
    Seeing a tenant taken from the request instead of the credential, closing every route that finds a record by ID alone, and leaving the caller no way to tell what exists in another tenant.
    First step
    Take two customers and one token of the first. Send the token to a route that names the second customer, and ask for an ID of the second customer's user, a list, a delete and a duplicate create. Write down which of these answers with data, with an effect, or with a different status from an ID that does not exist.
    Follow-ups

    From the lesson SCIM 2.0 endpoints that keep tenants apart

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

  10. Mid to senior

    A review finds that the Users endpoint doubles the single quotes in the filter parameter and pastes the result into a SQL query. The developer says that this is enough. Show why it is not, and describe how you would rebuild it.

    What it tests
    Treating a filter as a language, naming what quote escaping leaves open (precedence, wildcards, case, errors, cost and write-only attributes), and building a parser with an allowlist, bound values and the tenant outside.
    First step
    Write ten filters that are valid and ten that are not, and send them with the tenant condition in mind. Look for a result from another tenant, a server error, a request that should have been refused, and a result that differs from the right one. An or in a valid filter is the first to try.
    Follow-ups

    From the lesson SCIM 2.0 endpoints that keep tenants apart

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

  11. Senior to staff

    Two customers use different identity providers. One sends a PATCH with the operation Replace, the path active and the string "False" to disable a user. The other sends a replace with no path and an object. Your handler takes only the RFC's example shape, so deactivation fails for both. What do you accept, and what do you refuse?

    What it tests
    Being liberal in the syntax that real providers send and strict about attributes, mutability and atomicity, using recorded request shapes as fixtures, and refusing loudly where a silent success would leave a person active.
    First step
    Collect the exact requests that each provider sends, with personal data removed, and write each one as a fixture with its expected result. Then list what a PATCH must never do, such as change an ID, write a prototype or leave half a change, and write those as fixtures too.
    Follow-ups

    From the lesson SCIM 2.0 endpoints that keep tenants apart

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

  12. Mid to senior

    A customer tells you that a former employee, deactivated in their identity provider three days ago, exported data from your product this morning. Your logs show a valid session. Explain how that can happen, how you identify which credential was used, and what you change so that it cannot happen again.

    What it tests
    Seeing that a flag does not end credentials that already exist, listing every kind of credential, finding the one that was used from the logs, and designing one switch with a test for each kind.
    First step
    Find the credential that made the export in the log, whether a session, a token, a key or a job, and when it was issued. Then set the time of the deactivation beside it. If the credential is older, its checks never looked at the state of the person.
    Follow-ups

    From the lesson Deprovisioning that ends access everywhere

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

  13. Senior to staff

    You are asked to add a nightly job that deactivates the accounts which the customer's identity provider no longer lists. What can go wrong, and what does the job check before it changes anything?

    What it tests
    Treating a list as untrusted input: completeness, scope, matching, local holds, limits on bulk changes, a plan before the action, and an audit and alert path.
    First step
    Write down the ways the list can be wrong: a failed page, an empty answer, a change of scope, a renamed user, a reused name. Then write down what the job would do for each of them if it trusted the list.
    Follow-ups

    From the lesson Deprovisioning that ends access everywhere

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

  14. Mid to senior

    An audit finds that an engineer who moved from finance to engineering a year ago can still approve invoices. How did that happen, and what do you change so that a move removes what the old team granted without removing the roles that the application's own administrators gave?

    What it tests
    Explaining privilege creep from a sync that only adds roles, recomputing the provider's roles from the current groups while keeping local roles, applying the change to open sessions, and alerting on bulk grants.
    First step
    Find where the invoice role comes from: a provider group, a sync that only adds, or someone inside the application. Then look at what the last syncs received and what they did with the groups the person left.
    Follow-ups

    From the lesson Deprovisioning that ends access everywhere

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

  15. Senior to staff

    An employee leaves, and a year later the company hires a different person with the same name and e-mail address. In another case the same person is rehired. Describe what your service does in each case with the old account, keys, authenticators and data, and what goes wrong in a design that finds accounts by user name.

    What it tests
    Telling a return from a reuse by the provider's subject, starting clean in both, keeping internal IDs that are never reused, and deciding about data before it is needed.
    First step
    Ask what the provider sends in each case, the same subject or a new one, and what the request to create or activate carries. Then ask what your service looks up first: the subject, the user name or its own internal ID.
    Follow-ups

    From the lesson Deprovisioning that ends access everywhere

    In the answer:

    • Model answer
    • Follow-up answers
    • Common mistakes
    • Rubric
    • Variants
    • about 4 minutes

All Web Security (OWASP Top 10:2025) interview questions · The Web Security (OWASP Top 10:2025) track