Cybersecurity Roadmap

Learn how to secure networks, applications, and systems against digital threats.

Overall Progress0%

Identity & Access Management

Explanation

Identity and Access Management (IAM) is the discipline of ensuring the right people have the right access to the right resources, for the right reasons. It covers identity, authentication, authorization, and auditing, plus the modern protocols — OAuth 2.0 and OpenID Connect — that web applications use to delegate access. This lesson explains the IAM lifecycle, roles and permissions, multi-factor authentication, tokens and sessions, and the difference between OAuth 2.0 (authorization) and OIDC (authentication).

Identity, Authentication, Authorization

Term	Question	Example
Identity	Who is this?	A username or email
Authentication	Prove it	Password + MFA
Authorization	What may they do?	RBAC role permissions
Accounting/Audit	What did they do?	Access logs

The IAM Lifecycle

Joiner: a new user is provisioned with the access their role needs.
Mover: access changes when a role changes.
Leaver: access is revoked promptly when someone leaves.

RBAC and Least Privilege

Role-Based Access Control (RBAC) assigns permissions to roles, and users to roles. Least privilege means granting only the permissions required for the job.

Multi-Factor Authentication (MFA)

Something you know (password).
Something you have (a token or phone).
Something you are (biometrics).

MFA requires at least two factors, so a stolen password is not enough to gain access.

Sessions and Tokens

After authentication, the user is given a session or token that represents their identity for subsequent requests, so they do not re-enter credentials every time.

OAuth 2.0

OAuth 2.0 is an authorization framework. It lets a user grant a third-party application limited access to a resource without sharing their password.

User

↓

Authorization server

↓

Access token

↓

Application

↓

Resource

OpenID Connect (OIDC)

OIDC is an identity layer built on top of OAuth 2.0. Where OAuth 2.0 issues access tokens (authorization), OIDC adds ID tokens that prove who the user is (authentication).

	OAuth 2.0	OpenID Connect
Purpose	Authorization	Authentication
Key token	Access token	ID token
Answers	What may the app access?	Who is the user?

Access, ID, and Refresh Tokens

Token	Purpose
Access token	Authorizes access to a resource
ID token	Proves the user’s identity
Refresh token	Obtains new access tokens without re-login

Scopes, Consent, and Service Accounts

Scopes define the specific permissions an app is requesting.
Consent is the user agreeing to those scopes.
Service accounts are machine identities for automated access.
Privileged accounts need extra protection and review.

Common IAM Failures

Over-permissioned users (no least privilege).
Shared or default credentials.
Access not revoked when someone leaves.
Weak or missing MFA on privileged accounts.
Confusing OAuth 2.0 (authorization) with authentication.

Examples

An OAuth authorization flow

A user grants a photo app access to their files.

text

1User → App (redirect) → Auth server → Consent → Access token → App → Files API

Output

(the app never sees the user’s password)

Key Takeaways

IAM governs identity, authentication, authorization, and auditing.
RBAC assigns permissions to roles; least privilege limits access.
MFA combines factors so a stolen password is not enough.
OAuth 2.0 is authorization; OIDC adds authentication.
Revoke access promptly through the joiner/mover/leaver lifecycle.

← PreviousCryptography Next →Network Security