Identity & Access Management
Masterclass
A practical, protocol-first guide to modern identity. Learn OAuth 2.0, OpenID Connect, JWT, and enterprise identity patterns — grounded in RFCs, not vendor docs.
Key Concepts at a Glance
AuthN vs AuthZ
Authentication (AuthN) — proving who you are. Credentials, MFA, passkeys. Output: a verified identity.
Authorization (AuthZ) — proving what you can do. Scopes, roles, permissions. Output: access granted or denied.
OAuth 2.0 vs OIDC
OAuth 2.0 — a delegated authorization framework (RFC 6749). Tells you what is allowed, not who the user is.
OpenID Connect — identity layer built on OAuth 2.0. Adds the ID Token so you know who authenticated.
Access Token vs ID Token
Access Token — for the Resource Server (API). Presented on every API call. Short-lived.
ID Token — for the Client app. Proves authentication happened. Validated once at login. Never sent to APIs.
Front Channel vs Back Channel
Front Channel — browser URL redirects. Visible. Used for authorization requests. Never carry sensitive tokens.
Back Channel — server-to-server HTTPS POST. Secure. Used for token exchange.
Learning Curriculum
Four topic modules — each grounded in primary RFCs and specifications.
OAuth 2.0 Fundamentals
The delegated authorization framework. Actors, scopes, channels, and why it exists.
Grant Types & Flows
Authorization Code, PKCE, Client Credentials, Device Auth — when and why to use each.
OpenID Connect
The identity layer. Why OAuth is not authentication, the ID Token, discovery, and SAML vs OIDC.
Tokens, JWT & Claims
JWT structure, RS256 vs HS256, JWKS, introspection, revocation, and token lifetime strategy.
Hands-On Labs
Run the AuthMatrix app locally and configure real identity scenarios step by step.
Local RBAC & JWT Fundamentals
Run the app locally, log in as four roles, test RBAC enforcement, and inspect JWT tokens.
⌛ 30 minOkta OIDC Authentication
Configure Okta as an OIDC provider, implement Auth Code + PKCE, map groups to roles.
⌛ 45 minMicrosoft Entra ID OIDC
Configure Entra ID with App Roles, understand the roles claim vs groups claim difference.
⌛ 45 minAPI Gateway: Dual-IdP JWT Validation
Use Azure APIM to validate JWTs from both Okta and Entra and normalize claims.
⌛ 90 minAPI Testing with Postman
Test every API endpoint across all four roles using local tokens, Okta, and Entra.
⌛ 30 minRun the Lab Environment
Clone the repo and start the local lab in 3 commands:
git clone https://github.com/sepand/AuthMatrix.git
cd AuthMatrix
npm install && npm run devThen open http://localhost:3000 — the full app runs locally with simulated auth.