Lab
Learn identity by doing.
Start from the map of the field, then follow real flows step by step, compare concepts that get confused, and walk through complete architectures. In order, or pick the one you need.
Your progress
0 of 16 labs completed
- First stepComplete your first labLocked
- Solid foundationsComplete every lab in FoundationsLocked
- Fluent in protocolsComplete every lab in Protocols and flowsLocked
- Halfway thereComplete 8 labsLocked
- Access keeperComplete every lab in Governance and privileged accessLocked
- IAM architectComplete every lab in ArchitecturesLocked
- Identity masterComplete all 16 labsLocked
Progress is saved only in this browser.
Foundations · 4 lab
- 01The map of IAM ✓ CompletedDirectory, AM, IGA, PAM and CIAM: what each one does and how they fit together.
- 02OAuth 2.0 vs OpenID Connect ✓ CompletedWhy OAuth 2.0 is not a login protocol, and what OpenID Connect adds on top.
- 03SAML vs OpenID Connect ✓ CompletedBoth do single sign-on. Where they differ, and how to choose for a new app.
- 04Workforce IAM vs CIAM ✓ CompletedSame protocols, opposite goals: what changes when the users are your customers.
Protocols and flows · 6 lab
- 05Anatomy of a login ✓ CompletedSign in with OpenID Connect and PKCE, from the click to the API call.
- 06SAML single sign-on ✓ CompletedSP-initiated SAML: AuthnRequest, signed assertion, session.
- 07Machine to machine ✓ CompletedClient credentials: a service gets a token for itself and calls an API.
- 08Sign in on a TV ✓ CompletedDevice authorization grant: a code on screen, approval on the phone.
- 09Refresh token rotation ✓ CompletedRotation and reuse detection: how the IdP notices a copied refresh token.
- 10Creating a passkey ✓ CompletedWebAuthn registration: a key pair bound to one website.
Governance and privileged access · 3 lab
- 11Joiner, mover, leaver ✓ CompletedSCIM provisioning: create, update and disable accounts automatically.
- 12Request, approve, review ✓ CompletedAn access request in IGA: policy checks, approval, provisioning and the review that takes it back.
- 13A privileged session ✓ CompletedPAM: just-in-time approval, an injected credential, a recorded session and rotation at the end.
Architectures · 3 lab
- 14Enterprise IAM architecture ✓ CompletedA reference workforce architecture: HR, IGA, directory, IdP, PAM and monitoring, scenario by scenario.
- 15Hybrid identity ✓ CompletedOn-premises AD and a cloud IdP together: sync, federation, conditional access, legacy apps and partners.
- 16CIAM architecture ✓ CompletedA customer identity platform: channels, bot defense, CIAM, consent, APIs and data, scenario by scenario.