AM & Access

The foundation of the IAM protocol stack — what a directory service is, the LDAP data model (DIT, DN, entries, objectClasses, schema), Active Directory's domains and forests, the shift to cloud directories like Entra ID and Okta, hybrid identity sync, and why the directory is the enterprise's crown jewels.

How SAML 2.0 federates identity into web apps — the IdP/SP/user roles and trust via metadata XML, SP-initiated vs IdP-initiated flows, the HTTP-Redirect/POST/Artifact bindings, the anatomy of a SAML assertion (Subject, Conditions, AuthnStatement, AttributeStatement), signing and encryption, and when SAML is still the right choice over OAuth/OIDC.

How OAuth 2.0 lets an app act on your behalf without your password — the four roles, access vs refresh tokens, the grant types and when to use each (Authorization Code + PKCE, Client Credentials, Device Code, Refresh Token; the deprecated Implicit and ROPC), scopes and consent, and what OAuth 2.1 changes. Plus the critical point: OAuth authorizes the client, it does not authenticate the user.

How OIDC turns OAuth 2.0 into real authentication — the ID token (JWT) vs the access token, standard claims (sub, iss, aud, exp, email…), the discovery (.well-known/openid-configuration) and UserInfo endpoints, JWKS validation, the Authorization Code/Hybrid/Implicit flows, and front-channel, back-channel, and RP-initiated logout.

How SCIM 2.0 standardizes user provisioning between identity providers and apps — the REST resource model (User, Group, EnterpriseUser), the /Users, /Groups, /Bulk and /Schemas endpoints, the CRUD + Search + PATCH operations, how SCIM drives the JML lifecycle and replaces custom scripts, and its real limitations around granular entitlements and dynamic roles.

The building blocks the protocols depend on — JWT structure (header, payload, signature), self-contained vs opaque/reference tokens, JWE for confidential payloads, PASETO as a safer alternative that avoids algorithm confusion, and how to validate a token: signature, expiry, audience, issuer, and revocation.

The identity protocols beyond the core four — Kerberos tickets still authenticating every Active Directory login, RADIUS behind corporate Wi-Fi and VPNs, the legacy SOAP-based WS-Federation and WS-Trust alive in big ERP estates, and the phishing-resistant FIDO2/WebAuthn/CTAP vanguard.

How NIST SP 800-63 turns 'how strong should this be?' into three independent dials — IAL (identity proofing), AAL (authenticator strength), and FAL (federation assurance) — each with three levels, and how to combine them to fit a use case's risk (for example, IAL2/AAL2 for banking).

Where identity protocols are heading — securing microservices and workloads with OAuth token exchange (RFC 8693), DPoP (RFC 9449), and SPIFFE in the service mesh; continuous access evaluation via CAEP and the Shared Signals Framework; and putting people back in control of their credentials with verifiable credentials, DIDs, and OpenID for Verifiable Credentials (OID4VCI/OID4VP).

How every access decision breaks down into three sequential stages — identification, authentication, and authorization — and why audit is a transversal pillar, not a fourth stage. We resolve the '3 vs 4 A's' confusion.

The five categories of authentication factors with their specific implementations (passwords, TOTP, push, FIDO2, biometrics, context), the difference between SFA/2FA/MFA, step-up authentication, and risk-based adaptive authentication (RBA).

Technical mechanics of the most-used MFA implementations — TOTP, SMS OTP, push, FIDO2/WebAuthn, passkeys, magic links — with their flows, specific vulnerabilities, and fallback patterns. Plus CAPTCHA: why it's not authentication but is a useful complement.

A practitioner's deep dive into biometric authentication: the main modalities, how matching works, the FAR/FRR/EER error metrics and the threshold trade-off, liveness detection and anti-spoofing (PAD), how templates must be stored, the privacy and regulatory constraints (BIPA, GDPR Art. 9), and behavioral biometrics.

How Single Sign-On lets one authentication unlock many applications: the difference between Web SSO, Enterprise SSO, and Social SSO, the concrete benefits for UX and security posture, the 'breaking the chain' blast-radius risk of a central identity provider, and why Single Logout (SLO) is so hard that it is often quietly ignored.

How web sessions are built and defended: cookie attributes (HttpOnly, Secure, SameSite, Domain, Path), server-side session tokens versus JWTs and their trade-offs, sliding versus absolute timeouts, idle timeout and forced re-authentication, how to actually revoke a session, and the controls against CSRF, XSS, and session hijacking.

Zero Trust as a security strategy, not a product: the NIST SP 800-207 principles (never trust always verify, assume breach, least privilege), the Policy Decision Point / Policy Enforcement Point / Trust Algorithm architecture, Continuous Adaptive Trust that re-evaluates the session throughout its life, why identity is the control plane, and the common myths.

Discretionary Access Control explained: the model where the owner of a resource decides who else may use it. The Lampson access control matrix and its two projections (ACLs and capabilities), Linux file permissions and POSIX ACLs, Windows DACLs, the trojan-horse weakness that makes DAC leaky, and where discretionary control still runs the world — from filesystems to Google Drive sharing.

Mandatory Access Control explained: a system-wide policy based on security labels that no user — not even a resource owner — can override. Security clearances and classifications, the Bell-LaPadula model (no read up, no write down) that closes the trojan-horse gap DAC leaves open, the Biba integrity mirror, and how SELinux, AppArmor, and Windows Mandatory Integrity Control bring military-grade MAC to everyday operating systems.

Role-Based Access Control explained: the model that runs access in most organizations by grouping permissions into roles that map to jobs. The user-role-permission indirection, the NIST/INCITS 359 standard (core, hierarchical, constrained), role hierarchies and separation of duties, role explosion and role mining, and how RBAC shows up in Active Directory groups, cloud IAM, and Kubernetes — plus exactly where its context-blindness forces a move to ABAC.

Attribute-Based Access Control explained: deciding access from attributes of the subject, resource, action, and environment evaluated at request time. The NIST SP 800-162 model, how ABAC solves the conditional-access problems RBAC cannot express, the central challenge of attribute governance, policy combining and the reverse-query problem, and why nearly every modern system ends up as a hybrid of roles and attributes rather than choosing one.

Policy-Based Access Control explained: making the authorization policy itself a first-class, explicit, externalized artifact written in a formal language and evaluated by a dedicated engine, rather than scattered through application code. How PBAC relates to ABAC, the shift to externalized authorization and policy decoupled from code, the policy lifecycle of authoring, testing, versioning, and reviewing, and how OPA/Rego, AWS Cedar, and XACML make it real.

Relationship-Based Access Control explained: deriving permissions from a graph of relationships between entities rather than from roles or standalone attributes. How ReBAC answers 'are you connected to this resource in the right way?', the relationship tuple and userset rewrites at the heart of Google Zanzibar, how a permission check becomes a graph traversal, the consistency and performance problems Zanzibar had to solve, and the ecosystem it spawned — OpenFGA, SpiceDB, Permify, and Ory Keto.

Next-Generation Access Control explained: the NIST standard (INCITS 565, born from the Policy Machine) that models users, attributes, objects, and policies as a single directed graph and computes access as a privilege path through it. How NGAC's assignments, associations, prohibitions, and obligations subsume RBAC, ABAC, and ReBAC under one formal framework, how a decision is derived from the graph, how it differs from XACML, and why its efficient review queries and deterministic evaluation matter even though adoption is still early.

The XACML reference architecture explained from first principles: the four-component pattern — Policy Enforcement Point, Policy Decision Point, Policy Information Point, and Policy Administration Point — that virtually every authorization system is built on. Learn each role through a plain analogy, trace a request through the whole decision flow, understand policy sets, rules, combining algorithms, and the four decision values, and see why XACML's XML faded while its architecture won everywhere.

How modern authorization engines write, test, and ship the policy that XACML left abstract. A deep, diagram-heavy tour of Open Policy Agent and Rego, AWS Cedar, and Casbin — their languages, decision models, deployment patterns, ecosystems (Gatekeeper, Conftest, Verified Permissions), and how to test and choose between them, with the same worked example implemented in all three.

How Google's Zanzibar paper turned authorization into a graph-reachability problem, why that solves relationship-shaped access (nested groups, shared folders, delegated permissions) that flat policy engines struggle with, and how OpenFGA, SpiceDB, and Ory Keto brought the model outside Google — including the 'new enemy' consistency problem and how zookies solve it.

The granularity spectrum every authorization decision sits on, from perimeter gateways down to per-relationship checks — what each level costs in latency, modeling effort, and blast radius, how layered architectures combine coarse and fine checks, why naive per-item checks create an N+1 authorization problem, and a decision framework for choosing the right granularity per feature instead of by default.

Where the PDP actually runs, made concrete: the sidecar pattern (Envoy ext_authz, OPA-Envoy, Istio/Linkerd authorization policies), running policy at the CDN edge before a request reaches your infrastructure, WASM as the portability layer that makes the same policy runnable in all these places, and what changes about policy distribution and the new enemy problem once the decision engine is spread across regions and clouds instead of living in one place.

A full worked capstone: taking one concrete cashback application from a feature list to real, deployed authorization — classifying each feature on the granularity spectrum, designing its RBAC role model and ABAC attributes, writing the actual Cedar, Casbin, and OpenFGA policy for each feature, deciding where each check runs, and testing all of it in CI. Every framework from this module, applied to one system, end to end.