Overview

Identity fundamentals

Identity and trust

Identity proofingPlanned
Credentials and keysPlanned
Certificates and PKIPlanned

Sign-in, SSO, and delegated access

Authentication methods and MFAPlanned
History of SSO
OAuth 2.0
- Foundations
- The authorization code flow
- Other grants and flows
  - Client credentialsPlanned
  - Device authorizationPlanned
  - The refresh token grantPlanned
  - JWT and SAML assertion grantsPlanned
  - Choosing a flowPlanned
- Clients and registration
  - Client IDs and registrationPlanned
  - Redirect URIs and client metadataPlanned
  - Client authentication methodsPlanned
  - Secrets and signed assertionsPlanned
  - Rotating client credentialsPlanned
- Tokens and resource servers
  - Using access tokensPlanned
  - Token formats and validationPlanned
  - Scopes and audiencesPlanned
  - Enforcing access at an APIPlanned
  - Refresh tokens and rotationPlanned
  - Token introspectionPlanned
  - Token revocationPlanned
- Application architectures
  - Server-rendered web applicationsPlanned
  - Browser applicationsPlanned
  - Backends for frontendsPlanned
  - Native applicationsPlanned
  - Command-line toolsPlanned
  - Service-to-service accessPlanned
- Security and failure cases
  - Redirect URI validationPlanned
  - Request correlation and CSRFPlanned
  - Code interception and injectionPlanned
  - Authorization server mix-upPlanned
  - Token theft and replayPlanned
  - Refresh token theftPlanned
  - OAuth security best practicesPlanned
- Advanced OAuth
  - Pushed Authorization Requests (PAR)RFC 9126
    The problem PAR solvesPlanned
    Pushing an authorization requestPlanned
    Using the request URIPlanned
    Validation and failure casesPlanned
  - JWT-Secured Authorization Requests (JAR)RFC 9101
    The problem JAR solvesPlanned
    Building a request objectPlanned
    Validating a request objectPlanned
    Using JAR with PARPlanned
  - JWT-Secured Authorization Responses (JARM)
    Protecting an authorization responsePlanned
    Following a JARM exchangePlanned
    Response validation and failuresPlanned
  - Authorization response issuer identification
    Identifying the authorization serverPlanned
    Checking the response issuerPlanned
    Mix-up attacks and failure casesPlanned
  - Rich Authorization Requests (RAR)RFC 9396
    When scopes need more detailPlanned
    Writing authorization detailsPlanned
    Processing and validating a requestPlanned
  - Resource indicators
    Selecting the intended resourcePlanned
    Requesting access to multiple resourcesPlanned
    Audience restrictions and validationPlanned
  - Step-up authentication challenges
    When an API needs stronger authenticationPlanned
    Following a step-up challengePlanned
    Handling unmet authentication requirementsPlanned
  - Demonstrating Proof of Possession (DPoP)RFC 9449
    Binding a token to a keyPlanned
    Creating a DPoP proofPlanned
    Validating proofs at the serverPlanned
    Nonces and replay handlingPlanned
  - Mutual TLS
    Authenticating a client with a certificatePlanned
    Certificate-bound access tokensPlanned
    Certificate rotation and validationPlanned
  - Token exchangeRFC 8693
    The problem token exchange solvesPlanned
    Delegation and impersonationPlanned
    Subject tokens and actor tokensPlanned
    Following a token exchangePlanned
    Scopes, resources, and audiencesPlanned
    Trust and validationPlanned
    Errors and failure casesPlanned
    Working through an examplePlanned
  - Authorization server metadata
    Discovering server capabilitiesPlanned
    Reading the metadata documentPlanned
    Validating metadata and issuer identityPlanned
  - Protected resource metadata
    Discovering a protected resourcePlanned
    Locating its authorization serversPlanned
    Trust and metadata validationPlanned
  - Dynamic client registration
    Registering a client dynamicallyPlanned
    Client metadata and software statementsPlanned
    Registration responses and errorsPlanned
  - Dynamic registration management
    Reading and updating a registrationPlanned
    Registration access tokensPlanned
    Removing a client registrationPlanned
  - Financial-grade API (FAPI)
    The purpose of a security profilePlanned
    How FAPI combines OAuth mechanismsPlanned
    Interoperability and conformance testingPlanned
- Implementation and operations
  - Implementing a clientPlanned
  - Authorization server responsibilitiesPlanned
  - Resource server responsibilitiesPlanned
  - Tracing and troubleshooting exchangesPlanned
  - Testing an OAuth integrationPlanned
  - Operating and monitoring an integrationPlanned
- History, legacy, and migration
  - From OAuth 1.0 to OAuth 2.0Planned
  - The implicit grantPlanned
  - The password grantPlanned
  - Migrating older integrationsPlanned
  - How the specifications evolvePlanned
OpenID Connect (OIDC)
- Foundations
  - From delegated access to sign-inPlanned
  - Providers and relying partiesPlanned
  - ID tokens and access tokensPlanned
- The sign-in exchange
  - Authorization code flow with OIDCPlanned
  - Authentication requests and responsesPlanned
  - Response types and response modesPlanned
  - State and noncePlanned
  - Authentication errorsPlanned
- Controlling authentication
  - Prompt and account selectionPlanned
  - Login hintsPlanned
  - Session age and reauthenticationPlanned
  - Authentication context and methodsPlanned
  - Requesting stronger authenticationPlanned
- Identity, claims, and UserInfo
  - Standard and custom claimsPlanned
  - Scopes and the claims parameterPlanned
  - The UserInfo endpointPlanned
  - Public and pairwise subject identifiersPlanned
  - Claim stability and privacyPlanned
- Discovery and client configuration
  - Provider discoveryPlanned
  - Issuer metadata and capabilitiesPlanned
  - Client registrationPlanned
  - Signing keys and JWKSPlanned
  - Configuring supported algorithmsPlanned
- Validation and trust
  - Validating an ID tokenPlanned
  - Issuer, audience, and authorized partyPlanned
  - Expiration and nonce checksPlanned
  - Flow-specific hash checksPlanned
  - Matching the UserInfo subjectPlanned
  - Key rotation and validation failuresPlanned
- Application accounts and sessions
  - Connecting a sign-in to an accountPlanned
  - Linking accountsPlanned
  - Establishing an application sessionPlanned
  - ReauthenticationPlanned
  - Offline access and refresh behaviorPlanned
- Logout and session coordination
  - Local logout and provider sessionsPlanned
  - RP-initiated logoutPlanned
  - Front-channel logoutPlanned
  - Back-channel logoutPlanned
  - Session managementPlanned
- Advanced OIDC
  - Aggregated claims
    Combining claims from multiple sourcesPlanned
    Reading and validating aggregated claimsPlanned
  - Distributed claims
    Locating claims at another sourcePlanned
    Retrieving and validating distributed claimsPlanned
  - Signed and encrypted messages
    Choosing which messages to protectPlanned
    Signing and encryptionPlanned
    Key selection and validation failuresPlanned
  - Third-party initiated login
    Starting sign-in from another servicePlanned
    Processing a login initiation requestPlanned
  - Backchannel authentication (CIBA)
    Separating the consumption and authentication devicesPlanned
    Following a CIBA exchangePlanned
    Poll, ping, and push modesPlanned
    Binding the authentication to the requestPlanned
- Implementation, testing, and migration
  - Implementing a relying partyPlanned
  - OpenID Provider responsibilitiesPlanned
  - Conformance testingPlanned
  - Diagnosing sign-in failuresPlanned
  - Understanding implicit and hybrid integrationsPlanned
SAMLPlanned
KerberosPlanned
WS-FederationPlanned

Authorization and policy

Permissions and access decisionsPlanned
Roles and RBACPlanned
Attributes and ABACPlanned
Policy evaluation and enforcementPlanned

Identity lifecycle and governance

DirectoriesPlanned
Provisioning and SCIMPlanned
Joiners, movers, and leaversPlanned
Access reviews and deprovisioningPlanned

Workload and agent identities

Service and workload identitiesPlanned
Credentials for workloadsPlanned
Agent identity and delegated authorityPlanned

Identity security

Threats and common failuresPlanned
Protecting tokens and sessionsPlanned
Credential and key rotationPlanned
Monitoring and incident investigationPlanned

YOUR ACCOUNT

Make yourself at home.

Create your Beyond the Login account.

By creating an account, you agree to the Terms of Service. Read how we handle your information in our Privacy Policy.

Already have an account? Sign in