Who's who in the lessons
The examples return to the same people, organizations and applications, so each new idea builds on a situation you already know. If you start in the middle, this page tells you who everyone is.
All of them are fictional, and so are their domains, identifiers and data.
The photo service and the printer
The Foundations, OAuth 2.0 and OpenID Connect lessons, and most specialist lessons, follow you, your photos, and the applications you let use them.
- The photo service Service
Where you keep your photo albums. It signs you in, decides who can see each album, and later issues tokens to other applications.
- Album 42 Identifier
One of your albums. Lessons use it whenever a request needs a specific thing to read or share.
- The printer Application
A separate printing application that turns your photos into a photo book. It is the client in most OAuth and OpenID Connect examples.
- user-2048 Identifier
Ava's account at the photo service. The OAuth and OpenID Connect lessons use it as her subject identifier in tokens, ID tokens and the collage app's account records.
- The yearly calendar Storyline
Every December the printer picks twelve of Ava's photos for a calendar while she is away, which is why it needs to keep access between visits.
- The printer's phone app Application
The printer's mobile app, used to show how native applications differ from web servers.
- The print lab Organization
The business that prints the books. The printer sends it orders with no person present, as a service acting for itself.
- The photo frame Application
A frame on your shelf with no keyboard, which signs in by showing a code you approve on your phone.
- The photo editor and photos-cli Application
An editor that runs in the browser and the photo service's command-line tool, used to compare application architectures.
- The storage service Service
An internal service the photo API calls on your behalf, used for service-to-service access and token exchange.
- Pixel Vault Organization
A second photo service the printer imports from. In security lessons it plays the server that is malicious or compromised.
- Lantern Studio Organization
A small design agency with a business account at the photo service and its own identity provider, used whenever an organization signs its people in. It returns in Retaining and minimizing identity records, where the photo service decides how long to keep its session, diagnostic and audit records.
- The collage app Application
A collage app at collage.example that turns Ava's photos into posters. It adds Continue with your photo account, which shows why an access token must never be accepted as proof of sign-in, and it is the relying party in the OpenID Connect lessons, with the printer as the other client.
- The mail service Service
Ava's email provider, at accounts.mail.example, and the second provider people can sign in to the collage app with. It issues pairwise subject identifiers, so Ava's subject there differs for each client.
- Ava and Cora Person
Two photo service customers. The Technical foundations lessons use Ava, full name Ava Archer, in their terminal, file and API examples, with Cora Diaz beside her in sample data. Later Ava signs up, registers a passkey and signs in with it, signs in to the printer, withdraws her approval of it and closes her account; Cora, her friend, approved the printer separately and is untouched by either change.
Troubleshooting incidents
The Troubleshooting lessons investigate failures between the printing company and the photo service, so the printer, the photo service and their customers return with a few new faces. Teammates, help desk operators and new starters who appear in one incident only are introduced in that lesson.
- Mara Person
A photo service customer whose reports open several incidents, starting with "We could not open your preview", which the first lesson traces to the stage where it failed. She returns with a refused return to the printer, a failed external sign-in, repeated requests to reconnect her photo account, and a call to the help desk.
- Tari Nwosu Person
A photographer who connected her photo account to the printing site, and who also orders prints for work at her employer, Lumen Studios. Her reports include a connection that asks her to sign in again after a month, a sign-in tab left open overnight, a sign-in the printing site refuses at its ID token checks, and a first sign-in through Lumen Studios that swaps her names.
- Esme Person
Runs a small photo studio with a business account at the photo service, whose team orders prints through the printing company's business portal. Her studio's sign-in to the portal breaks after a SAML library migration, and later a new team member appears twice in the printing account after an upstream failure.
- Keiko Person
A printing company employee who manages print orders. The HR connector cannot find her account in the photo service's business directory after an upgrade, and later her company sign-in to the photo service's workspace is refused.
- Lumen Studios Organization
A partner business whose staff sign in to the printer with their own company accounts, used where an external sign-in reaches the wrong account or the wrong name.
Harbor Clinic
Identity proofing, issuing and revoking certificates, and the workforce lessons of Identity governance take place at a health clinic. Its privacy lessons return to the photo service, and its customer and partner lessons to the photo service and Cedar.
- Harbor Clinic Organization
A clinic launching a patient portal. The early lessons call it simply the clinic; the Governance lessons follow its staff.
- Alex Person
A long-time patient who wants a portal account to read test results.
- The outside laboratory Service
Runs Alex's blood tests and signs the results it sends to the clinic.
- Dana Okafor Person
A registered nurse joining pediatrics. The Governance lessons follow Dana's access from hire onward, and several of them follow a later surname change to Dana Mensah through the directory and the applications.
- Sam Reyes Person
A pediatrics nurse whose move to oncology shows which access recalculates and which stays behind.
- Dr. Lee Moreau Person
A locum physician whose contract ends and who is later hired again.
- Jordan Ellis and Morgan Hale Person
The clinic's IT administrator and the records manager who owns access to patient records.
- Priya Nair Person
The billing supervisor, whose parental leave and supplier payment approvals show how access is paused and how duties are kept apart.
- Lin Wong Person
A pharmacist who left in August and whose pharmacy account the leaver process missed.
Cedar Inc.
SAML, Identity security, Privileged access and Enterprise directories take place at a fictional company, and the partner, enterprise directory and verifiable credentials lessons add its partner organization.
- Cedar Inc. Organization
A company whose staff sign in to the services it buys, and whose incident the Identity security lessons investigate.
- Avery Person
A Cedar employee whom the SAML lessons sign in to the services Cedar buys.
- The training service Service
An online training service Cedar buys for its staff. It is the SAML service provider in most SAML lessons, receiving Cedar's assertions at its assertion consumer service.
- The expense service Service
A second service that trusts Cedar's identity provider, used to show why an assertion for one service must be refused by another, why each service gets its own NameID, and how logout reaches both.
- Birch Ltd. Organization
Another customer of the training service, and later a company Cedar acquires. Its staff keep their own SAML identity provider, so a federation broker signs them in to Cedar's OpenID Connect expense application.
- Riley Person
A member of Cedar's finance team whose sign-in is phished, which starts the incident. The Enterprise directories lessons follow Riley's account through Cedar's Active Directory and its Kerberos tickets, and in the Verifiable credentials lessons Riley holds Cedar's course credential and presents it to Northwind.
- Quinn Person
Works on Cedar's security team, receives the first alert and afterwards lists every way someone could control Cedar's systems.
- Rowan Person
Works on Cedar's help desk and refuses a fake reset request.
- Invoice Sync Application
A malicious app the attacker approves while signed in as Riley, to keep access after the password changes.
- Northwind Organization
A partner organization with its own sign-in and its own directory forest. Cedar invites its people to shared projects, the Enterprise directories lessons follow the trust between the two forests, and Northwind later checks a course credential Cedar issued.
- Talia Sato Person
A Northwind designer whom Cedar invites as a sponsored guest to view one album for its spring launch.
- Sora Person
A Cedar employee who also orders prints from the photo service, used to compare a workforce account with a customer account. When Sora leaves Cedar, the closed work mailbox shows why a customer account should not depend on it.
The Tidewell Gazette
Authorization and policy, including Access in context, takes place at a regional newspaper whose photo library runs on the photo service.
- The Tidewell Gazette Organization
A newspaper with Sports and News photo libraries, used to design permissions, roles and policies.
- Theo Person
The library administrator, who decides who may do what.
- Omar and Lena Person
The sports desk picture editor, and a freelance photographer hired for one assignment. In Access in context, Omar downloads photos from a personal laptop and a managed one, and Lena's access ends with her contract while she is still signed in.
- Maya Person
A staff photographer whose festival photo shows why every request must check the object itself. In the roles lessons she covers the sports picture desk for two weeks while Omar is away.
- The Riverside festival album Storyline
The album Lena is hired to fill, used to show access limited to one assignment and one period.
- Raj Person
A member of the Gazette's legal team, whose legal holds on photos show a rule that must win over ordinary permissions, and who later needs a short emergency grant to produce a held photo for a court.
Specialist storylines
Some specialist groups add a storyline of their own on top of the photo service and the printer.
- Lakeside Bank and Pay by bank Storyline
Ava paying for a photo book straight from her bank account, used where a request needs strong protection and exact details.
- The support console Application
The printing company's tool that lets a support agent see your order as you see it, used for delegation and impersonation.
- Northfield University Organization
Ava's university, which vouches that she is a student so the collage app can offer her a discount on posters, either in a statement the photo service carries or at its own claims endpoint.
- The poster kiosk Application
The collage company's self-service poster kiosk in a print shop, where Ava names her photo account and approves the sign-in on her own phone.
- The printer's workloads Storyline
The order service, render service, nightly batch job and deployment pipeline behind the printer, each moving from one shared key to an identity of its own.
- The photo book assistant Application
An AI assistant that runs errands with your photos and the printer, used to show delegated, narrow, approved and revocable authority for an agent.