Identity & Authentication 🔐
A 6-stage, 26-submodule curriculum that takes you from “what is a token?” to designing zero-trust, multi-tenant, cross-cloud identity fabrics. Built for DevOps/SRE/Security engineers who have to ship identity, not just consume it.
Curriculum Map
| Stage | Focus | Modules | Status |
|---|---|---|---|
| Stage 0 | Primitives — crypto, encoding, HTTP/TLS alphabet | 3 | ⬜ |
| Stage 1 | JWT — the token, end to end | 5 | ⬜ |
| Stage 2 | OAuth 2.0 — the authorization framework | 6 | ⬜ |
| Stage 3 | OIDC — identity layer on top of OAuth | 5 | ⬜ |
| Stage 4 | Federation, SSO, SAML 2.0, B2B | 6 | ⬜ |
| Stage 5 | Security, attacks, hardening, SIEM | 4 | ⬜ |
| Stage 6 | Production, scale, frontier (DPoP, PAR, FAPI) | 4 | ⬜ |
| Capstone | Keycloak reference lab + incident tabletop | 2 | ⬜ |
Total: 26 submodules + 2 capstone deliverables.
How to Use This Curriculum
- Linear path — start at stage 0, do all modules in order, finish with the capstone. Designed so each module assumes the prior stages are done.
- Reference path — jump straight to the stage you need (e.g. an engineer debugging JWT validation goes to Stage 1.3).
- Code-first — every module has working Python/Go snippets you can run, plus a
DevOps analogysection tying it to infrastructure you already know.
Audience
- DevOps/SRE engineers building or operating auth services
- Security engineers designing zero-trust architectures
- Platform engineers integrating OIDC into internal platforms
- Backend engineers who own the auth code and need to understand why, not just how
Prerequisites
- Comfort with HTTP, JSON, basic Linux/CLI
- Basic Python (all code examples are Python or Go)
- No prior auth experience required — Stage 0 builds the alphabet
Conventions
- Every module has the same skeleton: Concept → How it works → Code → DevOps analogy → Attacks/pitfalls → Exercises
- Wikilinks use the canonical form
[stageN/MM-slug|Display Name] - YAML frontmatter on every file (title, tags, date, description)
- Code blocks are language-tagged and runnable
Quick Links
- New here? Start with Stage 0.1 — Cryptographic Building Blocks
- Know JWT, need OAuth? Jump to Stage 2
- Auditing an existing system? Go to Stage 5.1 — The Top 12 Attacks
- Want to build it end-to-end? The Keycloak capstone walks a full local lab
More in this section
- SAML — Imagine a scenario: You need to access multiple web applications at work, each with its own login system. Logging in to each one…
Further reading
- Oauth2 (thread)
- OIDC — openid.net
- OIDC: To understand the concepts in a practical way — oauth.com
- OIDC: Comprehensive Video covering most of the topics (video)
Across the wiki
- AWS IAM — identity and access (AWS)
- EntraID — identity and access (Azure)
- GCP Identity & Access Management (IAM) — identity and access (GCP)
- RBAC (Role-Based Access Control) — identity and access (Kubernetes)