Troubleshoot Sso Saml Attribute Mapping Sts Audit Logs | Professional Cloud Security Engineer | StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Troubleshoot Sso Saml Attribute Mapping Sts Audit Logs

Section: Configuring Google Cloud Directory Sync and implement single sign-on (SSO) with a third-party identity provider.

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise configured SAML 2.0 federation with a third-party Identity Provider (IdP) using Workforce Identity Federation to allow external corporate users to access Google Cloud resources. After rolling out an update to the IdP's claim schema, several users report that they cannot sign in, receiving authorization errors during the token exchange process.

The security team needs to inspect the incoming SAML assertion claims, identify any mismatched attribute mappings (such as google.subject and google.groups), and verify why the token exchange is failing.

Which troubleshooting approach should the security engineer take?

Enable VPC Flow Logs on the subnet hosting the workload and filter for TCP port 443 traffic destined for Google APIs.

Inspect the local GCDS configuration XML file stored in ProgramData to review incoming SAML assertion tokens.

Enable Data Access audit logs for the Security Token Service API and inspect the token exchange requests in Cloud Audit Logs.

Review Event Threat Detection findings in Security Command Center to detect SAML attribute mapping errors.

Professional Cloud Security Engineer

Troubleshoot Sso Saml Attribute Mapping Sts Audit Logs

Related questions