In large clusters, what protocol is recommended to handle user authentication against external identity providers?

In large clusters, what protocol is recommended to handle user authentication against external identity providers?

• A. SAML
• B. Open ID Connect (OIDC)
• C. OAuth 1.0
• D. LDAP

Answer: (B)

OpenID Connect is chosen because it provides a modern, scalable way to federate authentication with external identity providers in large Kubernetes clusters. It sits on top of OAuth 2.0 and issues identity tokens (ID tokens) from the IdP, along with a user info endpoint that returns standardized user attributes and group information. This token-based approach is stateless, easy to scale across thousands of users, and enables reliable single sign-on while you map IdP groups and claims to Kubernetes RBAC roles. It’s widely supported by major IdPs (such as Azure AD, Google, Okta, and others) and simplifies provisioning, revocation, and auditing in large environments. SAML can work for federation but tends to be more complex to configure and maintain in dynamic clusters; LDAP is a directory service rather than a modern IdP, and OAuth 1.0 is outdated and lacks current identity federation capabilities.

OpenID Connect is chosen because it provides a modern, scalable way to federate authentication with external identity providers in large Kubernetes clusters. It sits on top of OAuth 2.0 and issues identity tokens (ID tokens) from the IdP, along with a user info endpoint that returns standardized user attributes and group information. This token-based approach is stateless, easy to scale across thousands of users, and enables reliable single sign-on while you map IdP groups and claims to Kubernetes RBAC roles. It’s widely supported by major IdPs (such as Azure AD, Google, Okta, and others) and simplifies provisioning, revocation, and auditing in large environments. SAML can work for federation but tends to be more complex to configure and maintain in dynamic clusters; LDAP is a directory service rather than a modern IdP, and OAuth 1.0 is outdated and lacks current identity federation capabilities.