An organization has just released a new mobile application for its customers. The application has
an inbuilt browser and native application to render content from existing websites and the
organization’s new web services gateway. All rendering of the content is performed on the mobile
application.
The application requires SSO between the application, the web services gateway and legacy UI.
Which of the following controls MUST be implemented to securely enable SSO?
A.
A registration process is implemented to have a random number stored on the client.
B.
The identity is passed between the applications as a HTTP header over REST.
C.
Local storage of the authenticated token on the mobile application is secured.
D.
Attestation of the XACML payload to ensure that the client is authorized.