Identity Between Systems
Sessions, tokens, delegation and federation. How one system tells another who you are without either of them lying.
The Session
You will be able to state precisely what it means to say that HTTP is stateless, quote the sentence in the specification that says it, and explain why…
11,999 words/52 min read37The Cookie
You will be able to read any Set-Cookie header aloud and say what every attribute on it does and which attack it was added to stop.
11,486 words/50 min read38The Token
You will be able to state, in the words of the specification, what makes a token a bearer token, and say what that property costs you.
12,044 words/52 min read39JSON Web Tokens
You will be able to take any JSON Web Token, split it correctly, decode both halves by hand without a tool, and say what every field in it means.
12,007 words/52 min read40OAuth 2.0
You will be able to name the four roles OAuth defines, say which real piece of software plays each one in a system you use, and spot the common mistake…
11,976 words/52 min read41OpenID Connect
You will be able to explain why a system built only on OAuth 2.0 cannot tell you who a user is, and name the exact step where the reasoning breaks.
12,944 words/56 min read42SAML and the Enterprise
You will be able to name the four layers of SAML — assertions, protocols, bindings and profiles — and say which OASIS document defines each one.
12,579 words/55 min read43Single Sign-On and Federation
You will be able to say exactly where single sign-on ends and federation begins, and name the boundary that separates them.
13,340 words/58 min read44Directories
You will be able to explain why a directory is a tree rather than a table, and name the 1988 standard that fixed its shape.
13,823 words/60 min read45Provisioning and the Lifecycle
You will be able to name the three events every identity system must handle — joiner, mover, leaver — and say which of the three nearly every…
12,109 words/53 min read46Deciding What You May Do
You will be able to state the difference between authentication and authorization in one sentence, and say precisely why the second question is the…
13,958 words/61 min read47Machines Have Identities Too
You will be able to explain why a running program needs an identity of its own, and name the four things that identity can be bound to.
13,908 words/60 min read