Cloud and Federated Identity
Core concepts
Cloud and federated identity extends IAM across trust boundaries. Federation lets an identity provider (IdP) assert identity to a service provider (SP) or relying party, so users authenticate once and access many systems. Know SAML (XML assertions for web SSO), OAuth 2.0 (delegated authorization via access tokens), and OIDC (identity layer on OAuth 2.0 using ID tokens). Understand trust relationships, metadata exchange, and assertion signing.
In cloud platforms, study identity vs. resource policies, roles and assume-role patterns, service principals/managed identities for workloads, and federation of on-prem directories to cloud. Understand conditional access policies (device, location, risk), cross-tenant/cross-account trust, and the shared responsibility model as it applies to identity. Know that cloud IAM is often policy-as-code and evaluated by a policy engine at request time.
Traps
A frequent trap: using OAuth access tokens as proof of user identity-access tokens authorize API calls; OIDC ID tokens carry identity claims. Another: confusing an IdP with an SP; the IdP issues assertions, the SP consumes them. Watch for over-broad trust policies (wildcard principals, long-lived federation) and questions that ignore token lifetime and audience restrictions.
Rule of thumb
Map every federation scenario to who asserts, who trusts, and what is in the token. Then constrain it: short token lifetimes, explicit audiences, signed assertions, and conditional access. If a workload needs cloud access, prefer short-lived federated credentials over long-lived static keys.