Lab

LessonWhat is Identity?

• Meet the first digital identities in your lab tenantReady

LessonEstablishing an identity

• Create accounts three ways and trace where each attribute came fromReady

LessonProving control of an account

• Sign in as Ava, then make her sign-in multi-factorReady

LessonDeciding what someone can do

• Least privilege for Ben, enforced on the serverPartly ready

LessonHow applications communicate

• Read real requests, redirects and errors from your tenantReady

LessonStaying signed in

• Watch a session start, change identifier and endPartly ready

LessonTrust across systems

• One sign-in, two relying parties, and an account that is not the samePartly ready

LessonProtecting credentials and messages

• Protect, read, validate and replay credentials in your tenantReady

LessonGiving another application limited access

• Let the photo printer read Ava's photos, and nothing morePartly ready

LessonHistory of SSO

• Trace the generations of single sign-on through your tenantPartly ready

LessonWhat proofing establishes

• Resolve a patient to one record and record what proofing establishedPartly readyIncludes a simulation

LessonProofing methods

• Compare what each proofing method really provesPlannedIncludes a simulation

LessonSecrets and key pairs

• Separate identifiers, shared secrets and key pairsPartly ready

LessonDigital signatures

• Verify a signed token the way the clinic wouldReady

LessonStoring and using keys

• Rotate your tenant's signing key without breaking anyoneReady

LessonWhat a certificate says

• Read your tenant's TLS certificate field by fieldReady

LessonCertificate authorities and chains

• Follow your tenant's certificate chain to a trust anchorReady

LessonValidating a certificate

• Run every certificate check, then read each failureReady

LessonIssuing, renewing, and revoking certificates

• Issue, renew and revoke certificates with a lab CAPartly ready

LessonMethods, credentials, and factors

• Follow the evidence in a real sign-inReady

LessonPasswords and PINs

• See what the tenant does with a passwordPartly ready

LessonCodes, links, and approval prompts

• Sign in by email link, email code and authenticator codePartly readyIncludes a simulation

LessonSecurity keys, passkeys, and biometrics

• Register and use a passkey bound to your tenantReady

LessonWhat makes authentication multi-factor?

• Count factors in amr, not screensReady

LessonEnrollment, replacement, and recovery

• Replace a method, use a recovery code and reset a lost userPartly ready

LessonAuthentication policy and SSO

• Freshness, step-up for role holders, and SSO across two applicationsPartly ready

LessonThe problem OAuth solves

• Delegate photo access without sharing a passwordReady

LessonRoles and endpoints

• Map the OAuth roles and endpoints onto your tenantReady

LessonTrust boundaries

• Decide, as the photo API, whether to trust a tokenPartly ready

LessonGrants, scopes, and consent

• Request, approve, deny and narrow access with scopesReady

LessonPublic and confidential clients

• Register the printer twice, as a confidential and a public clientReady

LessonWhy use the authorization code flow?

• See what the browser carries in the code flow, and what it does notReady

LessonFollowing the complete exchange

• Run one printer connection and label every messageReady

LessonThe authorization request

• Build the printer's authorization request one parameter at a timeReady

LessonRedirects and authorization codes

• Test exact redirect matching and how the tenant handles codesReady

LessonProof Key for Code Exchange (PKCE)

• Compute, send and prove a PKCE verifierReady

LessonCorrelating requests and responses

• Keep a pending transaction per session and check who answeredPartly readyIncludes a simulation

LessonExchanging a code for tokens

• Build the printer's token request by handReady

LessonErrors and denied access

• Handle denial, rejection and a lost response, then run the complete exchangeReadyIncludes a simulation

LessonThe refresh token grant

• Rotate refresh tokens and watch reuse revoke the whole chainReady

LessonClient credentials

• Get a machine-to-machine token and check it every wayReady

LessonDevice authorization

• Approve a photo frame on another screen with device authorizationPlanned

LessonJWT and SAML assertion grants

• Exchange a trusted assertion for an access tokenPlanned

LessonChoosing a flow

• Prove each client can use only the grant that fitsReady

LessonClient IDs and registration

• Read a client registration as a set of rulesReady

LessonRedirect URIs and client metadata

• Register return addresses and see what consent showsPartly ready

LessonClient authentication methods

• Hold a client to one authentication methodPartly ready

LessonSecrets and signed assertions

• Handle a shown-once secret and plan the move to private_key_jwtPartly ready

LessonRotating client credentials

• Rotate a client secret without overlap, then signing keys with overlapPartly ready

LessonUsing access tokens

• Present an access token correctly and read every refusalReady

LessonToken formats and validation

• Validate a JWT access token in order and follow a key rotationPartly ready

LessonScopes and audiences

• Give the photo API and the sharing API separate audiencesPartly ready

LessonEnforcing access at an API

• Watch an API check token, scope and object, in that orderReady

LessonRefresh tokens and rotation

• Rotate a refresh token family, tune its reuse grace, and end itReady

LessonToken introspection

• Validate reference tokens by introspection, with a cache that fails closedReady

LessonToken revocation

• Disconnect the printer and measure what stops workingPartly ready

LessonServer-rendered web applications

• Play the printer's backend and keep every token off the browserReady

LessonBrowser applications

• Run a browser-only public client from 127.0.0.1 and see where tokens liveReady

LessonBackends for frontends

• Move the browser client's tokens into a small backend for frontendReady

LessonNative applications

• Sign a desktop app in through the system browser with PKCEPartly ready

LessonCommand-line tools

• Build a command-line login with a temporary loopback listenerPartly ready

LessonService-to-service access

• Call a storage service from the photo API and see what each shortcut losesPartly ready

LessonRedirect URI validation

• Probe exact redirect URI matching with near-miss addressesReady

LessonRequest correlation and CSRF

• Confirm a callback is bound to the browser that started itReady

LessonCode interception and injection

• See PKCE, single use and short lifetimes refuse a misplaced codeReady

LessonAuthorization server mix-up

• Check iss at one callback shared by two real authorization serversPartly ready

LessonToken theft and replay

• Measure what limits a copied access tokenPartly ready

LessonRefresh token theft

• Race two copies of a refresh token and see what rotation catchesPartly ready

LessonOAuth security best practices

• Audit your tenant and your clients against RFC 9700, row by rowReady

LessonThe problem PAR solves

• See what a browser-carried authorization request exposesPartly ready

LessonPushing an authorization request

• Push an authorization request from the back endPlanned

LessonUsing the request URI

• Redeem a pushed request URI in the browserPlanned

LessonValidation and failure cases

• Break pushed requests, then require PAR for one clientPlanned

LessonThe problem JAR solves

• Compare a server's record with a signature anyone can verifyPlanned

LessonBuilding a request object

• Build a request object and send it by value or by referencePlanned

LessonValidating a request object

• Follow the tenant's request object checks in orderPlanned

LessonUsing JAR with PAR

• Push a signed request object with a client assertionPlanned

LessonProtecting an authorization response

• Read a plain authorization response, then plan a signed onePlanned

LessonFollowing a JARM exchange

• Ask for a signed response in each JARM response modePlanned

LessonResponse validation and failures

• Validate a signed authorization response in the right orderPlanned

LessonIdentifying the authorization server

• Read the issuer in every authorization response from two providersPartly ready

LessonChecking the response issuer

• Build the collage app's callback issuer checkPartly readyIncludes a simulation

LessonMix-up attacks and failure cases

• Keep the issuer check strict when configuration driftsPartly ready

LessonWhen scopes need more detail

• Ask for one album instead of the whole photo libraryPlanned

LessonWriting authorization details

• Write album and payment authorization details and send each the right wayPlanned

LessonProcessing and validating a request

• Validate, approve and enforce authorization details end to endPlannedIncludes a simulation

LessonSelecting the intended resource

• Name the API you want a token for with the resource parameterPlanned

LessonRequesting access to multiple resources

• Approve two APIs once and get one token per APIPlanned

LessonAudience restrictions and validation

• Make your photo API refuse tokens meant for another APIPartly ready

LessonWhen an API needs stronger authentication

• Read what an access token says about how and when Ava signed inPartly ready

LessonFollowing a step-up challenge

• Follow a step-up challenge from challenge to retryPartly ready

LessonHandling unmet authentication requirements

• End every step-up attempt cleanly, with photos deleted or clearly keptPartly ready

LessonBinding a token to a key

• Bind the phone app's tokens to a key it generatedPlanned

LessonCreating a DPoP proof

• Build DPoP proof contents and hashes by handPlanned

LessonValidating proofs at the server

• Watch the tenant check DPoP proofs at the token endpoint and UserInfoPlanned

LessonNonces and replay handling

• Add freshness, jti tracking and server nonces to DPoP proofsPlanned

LessonAuthenticating a client with a certificate

• Authenticate the order service with a client certificatePlanned

LessonCertificate-bound access tokens

• Bind an access token to a client certificatePlanned

LessonCertificate rotation and validation

• Rotate a client certificate without an outagePlanned

LessonThe problem token exchange solves

• Try three ways to call the storage service on Ava's behalfPlanned

LessonDelegation and impersonation

• See who the downstream token says is acting, by delegation and by impersonationPlanned

LessonSubject tokens and actor tokens

• Label your tenant's tokens, then send a subject token and an actor token togetherPlanned

LessonFollowing a token exchange

• Send a token exchange request field by field and follow the new tokenPlanned

LessonScopes, resources, and audiences

• Exchange for a narrower token and see which targets and scopes are refusedPlanned

LessonTrust and validation

• Decide who may exchange which token, and what storage checks afterwardsPlanned

LessonErrors and failure cases

• Classify token endpoint errors before deciding whether to retryPartly ready

LessonWorking through an example

• Follow Ava's request through a two-hop token exchange chainPlannedIncludes a simulation

LessonDiscovering server capabilities

• Configure a client from nothing but an issuerReady

LessonReading the metadata document

• Read your tenant's metadata member by member and prove supported is not allowedReady

LessonValidating metadata and issuer identity

• Validate metadata before the collage app uses a single endpointPartly ready

LessonDiscovering a protected resource

• Find an API's metadata starting from nothing but its addressPlannedIncludes a simulation

LessonLocating its authorization servers

• Go from an API's address to an access token for that APIPlannedIncludes a simulation

LessonTrust and metadata validation

• Make your discovery client refuse a document that describes a different APIPlannedIncludes a simulation

LessonRegistering a client dynamically

• Register a review-site client through the registration APIPlanned

LessonClient metadata and software statements

• Register installations from a trusted software statementPlanned

LessonRegistration responses and errors

• Read what was really registered and handle each registration errorPlanned

LessonReading and updating a registration

• Read, modify and write back a client registrationPlanned

LessonRegistration access tokens

• Guard and rotate a registration access tokenPlanned

LessonRemoving a client registration

• Delete a client and test which of its tokens stop workingPlanned

LessonThe purpose of a security profile

• Narrow your tenant to a written security profilePartly ready

LessonHow FAPI combines OAuth mechanisms

• Run a FAPI 2.0 payment flow, and gap-check your tenant todayPlanned

LessonInteroperability and conformance testing

• Write negative tests for your tenant, then plan the conformance suitePartly ready

LessonImplementing a client

• Build a client module configured from metadata, with one place for each jobReady

LessonAuthorization server responsibilities

• Operate your tenant as an authorization server for a dayPartly ready

LessonResource server responsibilities

• Run a production and a staging API and keep their facts correctPartly ready

LessonTracing and troubleshooting exchanges

• Trace a failed connection by correlation ID and request IDReady

LessonTesting an OAuth integration

• Write tests for your validator, your callback checks and your refresh lockPartly ready

LessonOperating and monitoring an integration

• Write a retry policy, test its rows, and read the signalsPartly readyIncludes a simulation

LessonFrom OAuth 1.0 to OAuth 2.0

• Compare a signed OAuth 1.0 request with a real bearer requestReadyIncludes a simulation

LessonThe implicit grant

• Turn on the implicit grant, read the fragment, and turn it offReady

LessonThe password grant

• Meet unsupported_grant_type, then sign in the browser way with a second stepReady

LessonMigrating older integrations

• Inventory and migrate a legacy clientPartly ready

LessonHow the specifications evolve

• Trace your tenant's metadata to the documents that define itReady

LessonFrom delegated access to sign-in

• Turn an access token into a false sign-in, then see the ID token refuse itReady

LessonProviders and relying parties

• Name the provider, the relying party and the issuer in your own tenantReady

LessonID tokens and access tokens

• Read an ID token and an access token side by side, and send each to the wrong readerReady

LessonFollowing a complete sign-in

• Run a complete OpenID Connect sign-in by hand, one message at a timeReady

LessonThe authentication request

• Reshape the authentication request one parameter at a timeReady

LessonState and nonce

• Deliver a code to the wrong attempt and see PKCE, then the nonce, catch itReady

LessonReceiving the ID token

• Send the token request yourself and take the response apartReady

LessonAuthentication errors

• Receive every sign-in error your tenant can return, and fail closedReady

LessonValidating an ID token

• Run every ID token check in order and keep only the answerReady

LessonIssuer, audience, and authorized party

• Refuse near-miss issuers, another client's token and an extra audienceReady

LessonExpiration and nonce checks

• Watch an ID token expire, separate iat from auth_time, and match nonces exactlyReadyIncludes a simulation

LessonSigning keys and rotation

• Rotate lab-collage's signing keys while a relying party keeps a cached key setReady

LessonWhen validation fails

• Produce the four kinds of validation failure and read them from your logsPartly readyIncludes a simulation

LessonProvider discovery

• Configure lab-collage from the issuer alone, and follow a moved endpointPartly ready

LessonReading provider metadata

• Change tenant settings, watch the metadata follow, and guard your refreshesPartly ready

LessonRegistering a relying party

• Map OpenID Connect registration settings onto lab-collagePartly ready

LessonSupporting several providers

• Run one relying party against two providers and stop a mix-up at the callbackPartly readyIncludes a simulation

LessonStandard and custom claims

• Read your tenant's standard claims and add a custom membership claimPartly ready

LessonScopes and the claims parameter

• Map scopes to the claims they release, and handle claims that never arrivePartly ready

LessonThe UserInfo endpoint

• Call UserInfo every allowed way and refuse a response for the wrong personPartly ready

LessonPublic and pairwise subject identifiers

• Correlate two clients through a public subject, then hand-build a per-sector onePartly ready

LessonClaim stability and privacy

• Reassign an email address and see why only issuer and subject identify a personPartly ready

LessonConnecting a sign-in to an account

• Key accounts on issuer and subject across two providersPartly ready

LessonLinking accounts

• Link a second provider only after both sides sign inPartly ready

LessonEstablishing an application session

• Separate the provider session, the app session and the ID tokenReady

LessonOffline access and refresh behavior

• Request offline access and compare refreshed ID tokensReady

LessonPrompt and account selection

• Drive the prompt values and read each answerReady

LessonLogin hints

• Suggest an account with login_hint, pin it with id_token_hintPartly ready

LessonSession age and reauthentication

• Demand a recent sign-in with max_age and check auth_time yourselfReady

LessonAuthentication context and methods

• Read amr from your tenant's authentication policyPartly ready

LessonRequesting stronger authentication

• Step up a role holder and enforce it in the relying partyPartly ready

LessonLocal logout and provider sessions

• Sign out of one app and watch the tenant sign you back inReady

LessonRP-initiated logout

• Ask the provider to end its sessionPlanned

LessonFront-channel logout

• Front-channel logout through a hidden framePlanned

LessonBack-channel logout

• Logout tokens and an administrator-ended sessionPlanned

LessonSession management

• Watch the provider session from the relying partyPlanned

LessonCombining claims from multiple sources

• Carry a second issuer's statement in UserInfoPlanned

LessonReading and validating aggregated claims

• Validate an embedded claims-provider JWTPlanned

LessonLocating claims at another source

• Follow a distributed claim referencePlanned

LessonRetrieving and validating distributed claims

• Fetch and validate a claim at another endpointPlanned

LessonChoosing which messages to protect

• Review how your tenant protects each OIDC messagePartly ready

LessonSigning and encryption

• Read a signature end to end and prepare an encryption keyPartly ready

LessonKey selection and validation failures

• Rotate a signing key against a cached key setPartly ready

LessonStarting sign-in from another service

• Launch a sign-in from a dashboard tilePlanned

LessonProcessing a login initiation request

• Build a safe login initiation endpointPartly readyIncludes a simulation

LessonSeparating the consumption and authentication devices

• Sign in on one device and approve on anotherPlanned

LessonFollowing a CIBA exchange

• Run a CIBA poll-mode exchangePlanned

LessonPoll, ping, and push modes

• Compare CIBA delivery modesPlannedIncludes a simulation

LessonBinding the authentication to the request

• Bind a backchannel request to the person in front of the screenPlanned

LessonImplementing a relying party

• Build a callback handler that fails closedReady

LessonOpenID Provider responsibilities

• Audit your tenant as an OpenID ProviderPartly ready

LessonResponse types and response modes

• Deliver one sign-in by query, fragment and form postReady

LessonUnderstanding implicit and hybrid integrations

• Verify at_hash and c_hash, then migrate to codeReady

LessonConformance testing

• Run the OpenID conformance suite against your tenantPartly ready

LessonDiagnosing sign-in failures

• Reproduce and diagnose seven sign-in failuresReady

LessonDesigning permissions

• Read and use the tenant permission catalogPartly ready

LessonChecking access to each object

• Object and field checks in the tenant's own APIsPartly ready

LessonRoles, assignments, and scope

• Build roles, assign them, and work out effective permissionsPartly ready

LessonDesigning a role model

• Design task-based custom roles for your tenantPartly ready

LessonAdministering roles safely

• Delegation limits, keeping an administrator, and removing accessPartly readyIncludes a simulation

LessonWriting rules with attributes

• Permit and forbid rules in a token policyPartly ready

LessonWhere attributes come from

• Token snapshots, fresh lookups and self-asserted valuesPartly ready

LessonContext, devices, and risk

• Freshness step-up and remembered browsers as contextPartly readyIncludes a simulation

LessonAccess through relationships

• Follow a relationship graph to a yes or a noPlanned

LessonSharing and revoking access

• Share, link, and revoke in the right orderPlanned

LessonDecision and enforcement points

• Find the enforcement and decision points in your tenant, then make one failPartly ready

LessonEvaluating a policy

• Rule targets, combining and traces in a token policyPartly ready

LessonEnforcing access across a system

• Every way into your tenant's directory, and two subjects in one requestPartly ready

LessonTesting, auditing, and changing policy

• Deny-first tests, staged rollout and rollback of a token policyPartly readyIncludes a simulation

LessonWhy access needs governance

• Make access drift in your tenant, then try to explain itReady

LessonIdentities, accounts, and entitlements

• Separate people, accounts and entitlements in your own tenantReady

LessonWhat a directory holds

• Read your tenant's directory the way an application doesReady

LessonSources of truth

• Make the HR Simulator the source of truth, then watch a copy disagreeReady

LessonSearching a directory with LDAP

• Search your directory with LDAP filters, and with their SCIM equivalents todayPlanned

LessonJoining an organization

• Bring a joiner in disabled, link her history, and let her activate on day oneReady

LessonChanging jobs

• Move people between jobs and find the access that stayed behindPartly ready

LessonLeaving an organization

• End a leaver's access, including the access that is already openReady

LessonContractors, rehires, and leave

• Govern contractors, bring a returning person back, and suspend for a leavePartly ready

LessonGetting accounts into applications

• Bring accounts into your tenant four different waysReady

LessonSCIM users, groups, and schemas

• Ask your tenant's SCIM service what it supports, and read exactly what you needReady

LessonSCIM requests and responses

• Send a joiner, a mover and a leaver over raw SCIM, and read every answerReady

LessonKeeping systems in sync

• Recover from lost answers, late writes, drift and a backlogReady

LessonAccess rules and birthright access

• Run birthright access rules against your simulated workforcePartly ready

LessonRequesting and approving access

• Request, approve, fulfil and confirm access, and see what the tenant cannot recordPlanned

LessonTemporary, privileged, and emergency access

• Give privileged work its own account, a stronger sign-in and a time limitPartly ready

LessonDesigning and maintaining roles

• Design roles from jobs, mine them from data, and keep them honestReady

LessonSeparation of duties

• Find toxic combinations in tenant administration and test the separations enforcedPartly ready

LessonAccess reviews

• Review a group with real context, close the loop, and fix a removal that comes backPartly ready

LessonOrphaned, dormant, and shared accounts

• Reconcile every account in your tenant and act on what you findReady

LessonEvidence and governance metrics

• Answer an auditor from your tenant's records, and measure whether governance worksPartly ready

LessonWhy attackers go after identity

• Inventory every path into Ava's accountReady

LessonThreat modeling an identity system

• Threat-model your tenant's password resetPartly ready

LessonGuessing, spraying, and stuffing

• Watch sign-in limits and breached-password screening workReady

LessonPhishing and relayed sign-ins

• Compare a relayable sign-in with a passkey sign-inPartly ready

LessonGetting around MFA

• Close the weaker fallback with authentication policyPartly ready

LessonAttacks on recovery and the help desk

• Guard recovery with fresh checks and a gated help desk resetPartly ready

LessonFake accounts and message abuse

• Watch send limits protect your own inboxReady

LessonHow sessions and tokens are stolen

• Choose session and token lifetimes, then end access on the serverPartly ready

LessonLimiting what stolen access can do

• Rotate refresh tokens, narrow scopes and see reuse end a token familyReady

LessonRevoking access and sharing security events

• Revoke each kind of access and measure the revocation gapPartly ready

LessonForged tokens and stolen signing keys

• Rotate, retire and disable a signing key as an exposure responsePartly ready

LessonAbusing federation and account linking

• Review every place your tenant decides which account this isPartly ready

LessonEscalating privilege

• Delegate role administration and watch the delegation limit holdReady

LessonProtecting privileged access

• Require a second step for role holders and keep the last administratorPartly ready

LessonHow attackers stay in

• Find out what survives a password change and a methods resetPartly ready

LessonAttacks through apps and integrations

• Control what apps can ask for, review consent and withdraw a grantPartly ready

LessonRecording identity activity

• Read one event end to end and follow its request IDReady

LessonDetecting identity attacks

• Write detection rules and test them against your own AuditPartly ready

LessonInvestigating an account compromise

• Investigate Cora's account by pivoting on IDs and build a timelineReady

LessonContaining and recovering

• Contain Ava's account in order, then give it back with a passkeyPartly ready

LessonRotating credentials and keys after exposure

• Rotate an exposed client secret, then rehearse a planned key rotationPartly ready

LessonLayered defenses and secure defaults

• Map each Cedar step to a layer in your tenantPartly ready

LessonReviewing identity security posture

• Review your tenant's security posture from its real settingsReady

LessonTesting identity defenses

• Write a scope, run negative tests against your own tenant and check detectionPartly ready