Skip to content

Beyond the LoginBeta

Your tenants

Create a tenant

A new tenant starts with its own users, OAuth settings, audit history and logs. You are its first Tenant Admin.

Tenant name

Learn Lab Docs Manage tenant

BTL Admin Log in Create account

LEARN IDENTITY

THE CURRICULUM In progress

Identity fundamentals

What is Identity?
Establishing an identity
Proving control of an account
Deciding what someone can do
How applications communicate
Staying signed in
Trust across systems
Protecting credentials and messages
Giving another application limited access

Identity and trust

Identity proofing
- What proofing establishes
- Proofing methods
Credentials and keys
Certificates and PKI

Sign-in, SSO, and delegated access

Authentication methods and MFA
History of SSO
OAuth 2.0
- Foundations
- The authorization code flow
- Other grants and flows
- Clients and registration
- Tokens and resource servers
- Application architectures
- Security and failure cases
- Advanced OAuth
  - Pushed Authorization Requests (PAR)RFC 9126
    The problem PAR solves
    Pushing an authorization request
    Using the request URI
    Validation and failure cases
  - JWT-Secured Authorization Requests (JAR)RFC 9101
    The problem JAR solves
    Building a request object
    Validating a request object
    Using JAR with PAR
  - JWT Secured Authorization Response Mode (JARM)
    Protecting an authorization response
    Following a JARM exchange
    Response validation and failures
  - Authorization response issuer identification
    Identifying the authorization server
    Checking the response issuer
    Mix-up attacks and failure cases
  - Rich Authorization Requests (RAR)RFC 9396
    When scopes need more detail
    Writing authorization details
    Processing and validating a request
  - Resource indicators
    Selecting the intended resource
    Requesting access to multiple resources
    Audience restrictions and validation
  - Step-up authentication challenges
    When an API needs stronger authentication
    Following a step-up challenge
    Handling unmet authentication requirements
  - Demonstrating Proof of Possession (DPoP)RFC 9449
    Binding a token to a key
    Creating a DPoP proof
    Validating proofs at the server
    Nonces and replay handling
  - Mutual TLS
    Authenticating a client with a certificate
    Certificate-bound access tokens
    Certificate rotation and validation
  - Token exchangeRFC 8693
    The problem token exchange solves
    Delegation and impersonation
    Subject tokens and actor tokens
    Following a token exchange
    Scopes, resources, and audiences
    Trust and validation
    Errors and failure cases
    Working through an example
  - Authorization server metadata
    Discovering server capabilities
    Reading the metadata document
    Validating metadata and issuer identity
  - Protected resource metadata
    Discovering a protected resource
    Locating its authorization servers
    Trust and metadata validation
  - Dynamic client registration
    Registering a client dynamically
    Client metadata and software statements
    Registration responses and errors
  - Dynamic registration management
    Reading and updating a registration
    Registration access tokens
    Removing a client registration
  - FAPI security profiles
    The purpose of a security profile
    How FAPI combines OAuth mechanisms
    Interoperability and conformance testing
- Implementation and operations
- History, legacy, and migration
OpenID Connect (OIDC)
- Foundations
- The sign-in exchange
- Validation and trust
- Discovery and client configuration
- Identity, claims, and UserInfo
- Application accounts and sessions
- Controlling authentication
- Logout and session coordination
- Advanced OIDC
  - Aggregated claims
    Combining claims from multiple sources
    Reading and validating aggregated claims
  - Distributed claims
    Locating claims at another source
    Retrieving and validating distributed claims
  - Signed and encrypted messages
    Choosing which messages to protect
    Signing and encryption
    Key selection and validation failures
  - Third-party initiated login
    Starting sign-in from another service
    Processing a login initiation request
  - Backchannel authentication (CIBA)
    Separating the consumption and authentication devices
    Following a CIBA exchange
    Poll, ping, and push modes
    Binding the authentication to the request
- Implementation, testing, and migration
SAMLPlanned
KerberosPlanned
WS-FederationPlanned

Authorization and policy

Permissions and access decisions
- Designing permissions
- Checking access to each object
Roles and RBAC
Attributes and ABAC
Relationships and ReBAC
- Access through relationships
- Sharing and revoking access
Policy evaluation and enforcement

Identity governance and administration

Foundations
- Why access needs governance
- Identities, accounts, and entitlements
Directories and sources of truth
Joiners, movers, and leavers
Provisioning and SCIM
Granting access
Roles and separation of duties
- Designing and maintaining roles
- Separation of duties
Reviews and evidence

Workload and agent identities

Service and workload identitiesPlanned
Credentials for workloadsPlanned
Agent identity and delegated authorityPlanned

Identity security

Understanding identity threats
- Why attackers go after identity
- Threat modeling an identity system
Account takeover
Sessions, tokens, and trust
Privilege and persistence
Detection and response
Building resilient identity systems

LearnNo related documents have been created yet. DocsNo related documents have been created yet. SupportAsk BTL Support for help with this page

Your profile: Log in

Account / Beyond the Login

Follow
the flow.

Learn how identity works, one step at a time.

Explore the lessons ↗

New here? Create an account

Welcome back

Log in to your account.

Email address

Password

Forgot password?

Other ways to sign in

Email address

Code from your email

New here? Create an account

v0.0.1-f20983e

Changelog About Privacy Policy Cookie Policy Terms of Service

We value your privacy

We use cookies and similar technologies to enhance your browsing experience, and analytics to understand our traffic. By clicking "Allow All", you consent to optional analytics. Cookie Policy

We value your privacy

We use cookies and similar technologies to enhance your browsing experience, and analytics to understand our traffic. By clicking "Allow All", you consent to optional analytics. Cookie Policy

ON THIS PAGE

Learn identity