AM & Access

The foundation of the IAM protocol stack: what a directory service is, the LDAP data model (DIT, DN, entries, objectClasses, schema), Active Directory's domains and forests, the move to cloud directories like Entra ID and Okta, hybrid identity sync, and why the directory is the enterprise's crown jewels.

How SAML 2.0 federates identity into web apps: the IdP, SP, and user roles and trust through metadata XML, SP-initiated and IdP-initiated flows, the Redirect, POST, and Artifact bindings, the anatomy of a SAML assertion, signing and encryption, and when SAML is still the right choice over OAuth and OIDC.

How OAuth 2.0 lets an app act on your behalf without your password: the four roles, access and refresh tokens, the grant types and when to use each (Authorization Code with PKCE, Client Credentials, Device Code, Refresh Token, and the deprecated Implicit and password grants), scopes and consent, and what OAuth 2.1 changes. Plus the key point: OAuth authorizes the client; it doesn't authenticate the user.

How OIDC turns OAuth 2.0 into real authentication: the ID token (a JWT) versus the access token, standard claims (sub, iss, aud, exp, email), the discovery and UserInfo endpoints, JWKS validation, the Authorization Code, Hybrid, and Implicit flows, and RP-initiated, front-channel, and back-channel logout.

How SCIM 2.0 standardizes user provisioning between identity providers and apps: the REST resource model (User, Group, EnterpriseUser), the /Users, /Groups, /Bulk, and /Schemas endpoints, the create, read, update, delete, search, and PATCH operations, how SCIM drives the JML lifecycle and replaces custom scripts, and its real limits around granular entitlements and dynamic roles.

The building blocks the protocols depend on: JWT structure (header, payload, signature), self-contained versus opaque reference tokens, JWE for confidential payloads, PASETO as a safer alternative that avoids algorithm confusion, and how to validate a token: signature, expiry, audience, issuer, and revocation.

The identity protocols beyond the core four: Kerberos tickets still authenticating every Active Directory login, RADIUS behind corporate Wi-Fi and VPNs, the legacy SOAP-based WS-Federation and WS-Trust alive in large ERP estates, and the phishing-resistant FIDO2, WebAuthn, and CTAP vanguard.

How NIST SP 800-63 turns 'how strong should this be?' into three independent dials, IAL (identity proofing), AAL (authenticator strength), and FAL (federation assurance), each with three levels, and how to combine them to fit a use case's risk (for example, IAL2 and AAL2 for banking).

Where identity protocols are heading: securing microservices and workloads with OAuth token exchange (RFC 8693), DPoP (RFC 9449), and SPIFFE in the service mesh; continuous access evaluation through CAEP and the Shared Signals Framework; and giving people back control of their credentials with verifiable credentials, DIDs, and OpenID for Verifiable Credentials (OID4VCI and OID4VP).

How every access decision breaks down into three stages in sequence, identification, authentication, and authorization, and why audit is a pillar that runs across all of them rather than a fourth stage. Along the way we settle the '3 versus 4 A's' confusion.

The five categories of authentication factors and their concrete forms (passwords, TOTP, push, FIDO2, biometrics, context), the difference between SFA, 2FA, and MFA, step-up authentication, and risk-based adaptive authentication (RBA).

The technical mechanics of the most used MFA implementations, TOTP, SMS codes, push, FIDO2 and WebAuthn, passkeys, and magic links, with their flows, specific weaknesses, and fallback patterns. Plus CAPTCHA, and why it isn't authentication but is a useful complement.

A practitioner's look at biometric authentication: the main modalities, how matching works, the FAR, FRR, and EER error metrics and the threshold trade-off, liveness detection and anti-spoofing (PAD), how templates must be stored, the privacy and regulatory constraints (BIPA, GDPR Article 9), and behavioral biometrics.

How single sign-on lets one authentication open many applications: the difference between web, enterprise, and social SSO, the concrete benefits for usability and security, the blast-radius risk of a central identity provider, and why single logout (SLO) is so hard that it's often quietly ignored.

How web sessions are built and defended: cookie attributes (HttpOnly, Secure, SameSite, Domain, Path), server-side session tokens versus JWTs and their trade-offs, idle and absolute timeouts, forced re-authentication, how to actually revoke a session, and the controls against CSRF, XSS, and session hijacking.

Zero Trust as a security strategy, not a product: the NIST SP 800-207 principles (never trust, always verify; assume breach; least privilege), the policy decision point, policy enforcement point, and trust algorithm architecture, continuous adaptive trust that re-evaluates the session throughout its life, why identity is the control plane, and the common myths.

Discretionary access control explained: the model in which the owner of a resource decides who else may use it. The Lampson access control matrix and its two projections (ACLs and capabilities), Linux file permissions and POSIX ACLs, Windows DACLs, the trojan-horse weakness that makes DAC leaky, and where discretionary control still runs the world, from filesystems to Google Drive sharing.

Mandatory access control explained: a system-wide policy based on security labels that no user, not even a resource owner, can override. Security clearances and classifications, the Bell-LaPadula model (no read up, no write down) that closes the trojan-horse gap DAC leaves open, the Biba integrity mirror, and how SELinux, AppArmor, and Windows Mandatory Integrity Control bring military-grade MAC to everyday operating systems.

Role-based access control explained: the model that runs access in most organizations by grouping permissions into roles that match jobs. The user-role-permission indirection, the NIST/INCITS 359 standard (core, hierarchical, constrained), role hierarchies and separation of duties, role explosion and role mining, and how RBAC appears in Active Directory groups, cloud IAM, and Kubernetes, plus exactly where its blindness to context forces a move to ABAC.

Attribute-based access control explained: deciding access from attributes of the subject, resource, action, and environment evaluated at request time. The NIST SP 800-162 model, how ABAC solves the conditional-access problems RBAC can't express, the central challenge of governing attributes, combining rules and the reverse-query problem, and why nearly every modern system ends up as a hybrid of roles and attributes instead of choosing one.

Policy-based access control explained: making the authorization policy itself an explicit, externalized artifact, written in a formal language and evaluated by a dedicated engine instead of scattered through application code. How PBAC relates to ABAC, the move to externalized authorization separated from code, the policy lifecycle of authoring, testing, versioning, and reviewing, and how OPA and Rego, AWS Cedar, and XACML make it real.

Relationship-based access control explained: deriving permissions from a graph of relationships between entities instead of from roles or standalone attributes. How ReBAC answers 'are you connected to this resource in the right way?', the relationship tuple and userset rewrites at the heart of Google Zanzibar, how a permission check becomes a graph traversal, the consistency and performance problems Zanzibar had to solve, and the ecosystem it spawned: OpenFGA, SpiceDB, Permify, and Ory Keto.

Next-generation access control explained: the NIST standard (INCITS 565, born from the Policy Machine) that models users, attributes, objects, and policies as a single directed graph and computes access as a privilege path through it. How NGAC's assignments, associations, prohibitions, and obligations take in RBAC, ABAC, and ReBAC under one formal framework, how a decision is derived from the graph, how it differs from XACML, and why its efficient review queries and deterministic evaluation matter even though adoption is still early.

The XACML reference architecture explained from first principles: the four-part pattern of policy enforcement point, policy decision point, policy information point, and policy administration point that almost every authorization system is built on. Learn each role through a plain analogy, follow a request through the whole decision flow, understand policy sets, rules, combining algorithms, and the four decision values, and see why XACML's XML faded while its architecture won everywhere.

How modern authorization engines write, test, and ship the policy XACML left abstract. A tour of Open Policy Agent and Rego, AWS Cedar, and Casbin: their languages, decision models, deployment patterns, ecosystems (Gatekeeper, Conftest, Verified Permissions), and how to test and choose between them, with the same worked example implemented in all three.

How Google's Zanzibar paper turned authorization into a graph-reachability problem, why that solves relationship-shaped access (nested groups, shared folders, delegated permissions) that flat policy engines struggle with, and how OpenFGA, SpiceDB, and Ory Keto brought the model outside Google, including the 'new enemy' consistency problem and how zookies solve it.

The granularity spectrum every authorization decision sits on, from perimeter gateways down to per-relationship checks: what each level costs in latency, modeling effort and blast radius, how layered architectures combine coarse and fine checks, why naive per-item checks create an N+1 authorization problem, and a way to choose the right granularity per feature instead of by default.

Where the PDP actually runs: the sidecar pattern (Envoy ext_authz, OPA-Envoy, Istio and Linkerd authorization policies), running policy at the CDN edge before a request reaches your infrastructure, WASM as the portability layer that lets the same policy run in all these places, and what changes about policy distribution and the new enemy problem once the decision engine is spread across regions and clouds instead of living in one place.

A full worked capstone: taking one concrete cashback application from a feature list to real, deployed authorization. Classify each feature on the granularity spectrum, design its RBAC roles and ABAC attributes, write the actual Cedar, Casbin and OpenFGA policy for each feature, decide where each check runs and test all of it in CI. Every framework from this module, applied to one system from start to finish.