Identity Labs
Step-by-step labs for configuring real identity providers, API gateways, and testing tools. Each lab builds on the previous. Start with Lab 1 — no cloud account required.
Before You Start
Required for all labs
- Node.js 18 or later (nodejs.org)
- Git
- The AuthMatrix repo cloned locally
git clone https://github.com/sepand/AuthMatrix.git
cd AuthMatrix
npm installRequired for specific labs
- Lab 2: Free Okta Developer account
- Lab 3: Microsoft 365 or Azure free tier
- Lab 4: Azure subscription (APIM resource)
- Lab 5: Postman desktop app
Local RBAC & JWT Fundamentals
Run the AuthMatrix app locally and log in as four different roles (Admin, Manager, Developer, Auditor). Observe how each role gets different HTTP responses from the API. Inspect the JWT token structure in the dashboard. Understand how Astro middleware and API middleware enforce RBAC independently.
Okta OIDC Authentication
Configure Okta as a real OIDC provider. Create an application in the Okta dashboard, configure PKCE-based Auth Code flow, set up Okta Groups for role mapping, and validate RS256 tokens using Okta's JWKS endpoint.
Microsoft Entra ID OIDC
Configure Microsoft Entra ID (Azure AD) as an OIDC provider using App Roles — the enterprise-native approach. Learn how the roles claim differs from Okta's groups claim and why normalization matters for multi-IdP applications.
API Gateway: Azure APIM with Dual-IdP JWT Validation
Deploy Azure API Management as the single enforcement perimeter for both Okta and Entra tokens. Configure inbound JWT validation policies for each IdP, normalize claims into a common header schema, and test from Postman. The only lab where both IdPs converge.
API Testing with Postman
Test every AuthMatrix API endpoint across all four roles using three authentication strategies: local mock tokens, Okta OAuth 2.0 (Authorization Code + PKCE), and Microsoft Entra OAuth 2.0. Includes a pre-built Postman collection.