Which token technologies do applications use to enforce access when using IdP?

• A. Password policy
• B. SAML/OIDC tokens from IdP
• C. Firewall configuration
• D. Backup schedule

Answer: (B)

Access control in this scenario hinges on tokens that the Identity Provider issues and the application consumes to verify who the user is and what they’re allowed to do. When the IdP issues tokens such as SAML assertions or OpenID Connect (OIDC) tokens, the application (the relying party) can validate the token’s signature, check its intended audience and expiration, and read the embedded claims (like user identity, group memberships, roles, or other attributes) to enforce authorization decisions. This federation-based approach enables single sign-on and centralized policy enforcement without the application having to manage credentials directly.

Password policy governs how passwords are created or rotated and does not provide a token usable by the application for access decisions. Firewall configuration deals with network perimeter controls, not identity tokens, and a backup schedule concerns data protection and recovery, not authentication tokens. Hence, SAML or OIDC tokens from the IdP are the mechanisms applications use to enforce access when relying on an IdP.