Back to Education

Identity and access management: OIDC, SAML and passkeys

Add secure sign-in, single sign-on, multi-factor authentication and multi-tenant authorization to your applications, with a real understanding of the protocols.

Duration: 6 days (48 hours) Level: Intermediate to advanced Target Audience: Backend and frontend developers, security engineers
OIDC OAuth 2.0 SAML Passkeys RBAC

Overview

A sign-in screen looks small, but identity is the most attacked surface of an application. In this training we walk through OAuth 2.0, OpenID Connect and SAML flow by flow, build passwordless sign-in with passkeys (WebAuthn) and design role- and attribute-based authorization for a multi-tenant application. The pitfalls we met while building MicroFrame’s identity and authorization components serve as examples.

Course content

1. Identity fundamentals

  • Authentication versus authorization
  • Identity provider, client and resource server
  • Sessions and tokens
  • Threat model: session theft, CSRF, open redirects

2. OAuth 2.0

  • The authorization code flow
  • PKCE
  • Client credentials and machine identities
  • Token exchange and impersonation
  • Scopes and audiences

3. OpenID Connect

  • ID tokens and claims
  • Discovery and JWKS
  • Token validation: signature, issuer, audience, lifetime
  • Logout and front-channel logout

4. SAML 2.0

  • Assertions and metadata
  • SP- and IdP-initiated flows
  • Signature validation and replay protection
  • Lab: adding OIDC sign-in to an application

5. Federation

  • Corporate identity providers: Entra ID, Google Workspace
  • Just-in-time provisioning
  • Account linking
  • User provisioning with SCIM

6. Multi-factor authentication

  • TOTP and e-mail codes
  • Trusted devices
  • Risk-based step-up
  • Attempt limits and brute-force protection

7. Passkeys and WebAuthn

  • Registration and authentication ceremonies
  • RP ID and origin rules
  • Platform and roaming authenticators
  • Common mistakes
  • Lab: passwordless sign-in with passkeys

8. Browser sessions

  • The BFF pattern: no tokens in the browser
  • Cookie attributes: __Host-, SameSite, HttpOnly
  • Cookie size and server-side sessions
  • Account recovery and password reset security

9. Authorization models

  • RBAC
  • ABAC and policy engines
  • Designing permission codes
  • Deny by default: fail closed

10. Multi-tenancy

  • Protecting the tenant boundary in the architecture
  • Taking the tenant context from a trusted source
  • Testing cross-tenant access

11. Service accounts

  • Machine tokens and their lifetimes
  • Least privilege
  • Revocation and rotation

12. Auditing

  • Audit logs: who, what, when
  • Tamper-evident logs
  • Compliance reports
  • Lab: an API protected by role and tenant

Schedule

Each module takes about 4 hours, half a day; 48 hours in total.

  • Day 1: modules 1 and 2
  • Day 2: modules 3 and 4
  • Day 3: modules 5 and 6
  • Day 4: modules 7 and 8
  • Day 5: modules 9 and 10
  • Day 6: modules 11 and 12

Prerequisites

  • Experience building web applications (backend or frontend)
  • HTTP, cookies and redirects
  • A development environment in a language of your choice

Training format

  • On site or remote: at your office or in live virtual sessions.
  • Hands-on: every day ends with lab sessions where you apply that day’s topic to a working example.
  • Lab environment: participants get a prepared working environment and a sample code repository.
  • Tailored to your team: content and examples are adapted to your stack after a short call before the training.
  • Materials: slides, lab guides and reference code stay with you after the training.
Ready to Start?

Ready to start your project?

Let's discuss how we can help bring your ideas to life.

Get in Touch Services