Access Control and Identity Management
What this domain tests
Access Control and Identity Management tests authentication, authorization, and accounting across users, services, and federated identities. Expect MFA, SSO, SAML, OIDC, OAuth scopes, RBAC and ABAC, least privilege, privileged access management, joiner-mover-leaver, and conditional access.
Core rules
- Authentication proves identity; authorization grants action; accounting records it. MFA combines factors from different categories: knowledge, possession, inherence.
- Prefer federated SSO with short-lived tokens; use OIDC for identity and OAuth 2.0 scopes for delegated API access. Validate issuer, audience, signature, and expiry.
- RBAC assigns permissions to roles, not individuals; ABAC evaluates attributes; MAC uses labels; DAC lets owners grant access. Least privilege and separation of duties apply to humans and service accounts.
- Manage lifecycle: approve, provision, review, change, and deprovision promptly. Use PAM, just-in-time elevation, and session logging for privileged access.
Worked example
A contractor needs read-only access to one cloud storage bucket for 30 days. Federate the contractor through the identity provider with MFA, map the contractor to a group with a read-only bucket policy, set an expiry and access review, and log access. Do not issue a shared account or a broad role. Reasoning: federation centralizes authentication, the group limits authorization, expiry enforces least privilege over time, and logs provide accountability.
Traps
Treating authentication as authorization; granting broad roles for convenience; shared accounts; forgetting deprovisioning after role change; accepting OAuth tokens without validating audience or issuer; and relying on passwords alone for privileged access.