Identity, Authentication, and Access Management
This domain tests identity architecture: how assurance levels are chosen, how authorization is modelled, how federation and lifecycle work, and where token handling fails. Expect specifics on NIST SP 800-63B, OAuth versus OpenID Connect, and provisioning.
Assurance and authenticators
NIST SP 800-63B defines AAL1 (single factor), AAL2 (multi-factor, verifier-impersonation resistant), and AAL3 (hardware-based, phishing-resistant, verifier-compromise resistant). Current guidance: no forced periodic rotation, no composition rules, screen against breached-password lists, rate-limit authentication attempts. Length and blocklisting matter more than complexity. Phishing-resistant means FIDO2/WebAuthn or PIV; SMS OTP and push are weaker against real-time phishing and SIM swap.
Authorization models
RBAC maps roles to permissions and suffers role explosion at scale. ABAC evaluates subject, resource, action, and environment attributes. ReBAC follows relationship graphs. Split the policy decision point (centralised decision) from the policy enforcement point (distributed enforcement). Least privilege is operationalised with just-in-time elevation, credential vaulting, and break-glass accounts that alert when used.
Federation and lifecycle
OAuth 2.0 is delegation using scopes and is not authentication; OpenID Connect adds an ID token on top. SAML 2.0 remains the enterprise SSO standard. SCIM handles provisioning. In joiner-mover-leaver, the mover is the usual gap: the new role is granted but old entitlements are not removed. Service accounts and API keys need named owners, inventory, and rotation.
Worked example
A B2B SaaS vendor adds enterprise SSO. Reasoning: map NameID or email to a stable internal identifier; choose SP-initiated SAML or OIDC. Just-in-time provisioning is fast but depends on IdP attributes and can create duplicates, and it does not deprovision. Because reliable deprovisioning is the driver, select SCIM for lifecycle plus SSO for authentication, and keep one documented break-glass local administrator with a hardware key and alerting, since an IdP outage would otherwise block operations.
Traps
- Using OAuth access tokens as proof of identity.
- Treating MFA as binary rather than assurance-tiered.
- Assuming SSO deprovisions accounts.
- Over-broad roles and unreviewed entitlements.
- Unmanaged service accounts.
- Long-lived access tokens and non-rotating refresh tokens.