Identity, Access, and Authentication
Domain 3 - Identity, Access, and Authentication
This domain tests authentication versus authorization, federation, MFA, and least-privilege access. Expect scenarios on SSO, OAuth/OIDC, SAML, role design, and credential attacks.
Core rules
- Authentication proves identity; authorization decides what that identity may do. A valid login does not imply access.
- Use least privilege and separation of duties. Prefer roles for coarse access and attributes for context-aware decisions.
- MFA should be phishing-resistant where risk is high; FIDO2/WebAuthn security keys resist push bombing and real-time phishing better than SMS or push alone.
- Federation delegates authentication to an identity provider. SAML is common for enterprise SSO; OIDC is built on OAuth 2.0 for identity.
- OAuth scopes limit delegated API access; consent phishing abuses legitimate grants and is not stopped by MFA.
Worked example
An attacker has a valid password and sends repeated MFA push prompts until the user approves. The failure is not password strength but MFA design. Controls: number matching, conditional access by device and location, FIDO2 keys, and user reporting. If the attacker completes an OAuth consent grant, revoke the grant and review scopes; resetting the password alone may not remove access.
Traps
Treating MFA as a complete control; confusing OAuth with authentication; giving service accounts interactive logins; and assuming SSO means every app enforces the same authorization.