IAM Training: Identity Management and Federation

Module 1 · The Stakes of an Identity Management Strategy (1.5 h)

• Why structure identity management: security, compliance, user experience, cost control.
• What identity and access management (IAM) covers: scope, stakeholders, identity lifecycle.
• The main approaches by context: internal enterprise, B2B, consumer (Internet).

Module 2 · Identification, Authentication and Authorisation (2 h)

• Distinguishing identification, authentication and authorisation: three often-confused concepts.
• Strong authentication: principles and use cases.
• Biometrics as an authentication factor: possibilities and limitations.
• Multi-factor authentication (MFA) with mobile devices.

Module 3 · Identity Administration and Governance (1 h)

• The identity lifecycle: creation, modification, suspension, deletion.
• Governance principles: access reviews, segregation of duties, traceability.
• The role of administration processes in reducing risk.

Module 4 · Directories and Authentication Databases (2 h)

• Centralised directory vs federated approach: advantages and limitations of each model.
• LDAP v3 directories: structure, schema, replication.
• Securing directory access: LDAPS, LDAP/TLS.
• Controlling and auditing access to directory objects, certificate publication.

Module 5 · Access Control Models (1.5 h)

• Comparing the main authorisation methods: DAC, MAC, RBAC, ABAC.
• Access control lists (ACLs): how they work and use cases.
• Choosing the right model for the organisational context.

Module 6 · Cryptography Concepts for IAM (2 h)

• Symmetric and asymmetric encryption: principles and respective uses.
• Hashes and digital signatures: ensuring integrity and authenticity.
• The digital certificate as a building block of trust.

Module 7 · Hardware Implementation of Cryptography (1 h)

• Storing private keys on hardware tokens (smart cards, YubiKey, etc.) and hardware security modules (HSMs).
• Using hardware containers to protect keys.
• Comparing security levels depending on the storage method chosen.

Module 8 · Public Key Infrastructure (PKI): The Fundamentals (2 h)

• X.509 v3 certificates and their role in a PKI.
• Defining an identity in a public key infrastructure.
• Determining certificate lifetimes and controlling access through attribute certificates.

Module 9 · Building a Certificate Management Strategy (2 h)

• Securing private keys: automatic archival, key recovery agent.
• Mapping identities to certificates and distributing trusted certificates.
• Publishing certificate revocation lists (CRLs) and managing the certification authority hierarchy (root, intermediate, issuing CA).
• Strengthening security with an offline root CA; assessing trust in external CAs and complying with a certificate policy.

Module 10 · Authentication and Identity Propagation Protocols (2 h)

• Identity propagation protocols: SAML, SOAP.
• Securing XML exchanges: XML Encryption, XML Signature.
• The role of these protocols in interoperability between systems.

Module 11 · Federated Identity Management and SSO (2 h)

• The principle of single sign-on (SSO) and its benefits.
• Ensuring interoperability through claims and open industry standards.
• The identity metasystem vision: federating without centralising.

Module 12 · Case Study: Federation with Microsoft ADFS (1 h)

• Local authentication and remote access in an ADFS architecture.
• Designing claims-based applications with SAML.
• Abstracting the WS-Trust and WS-Federation protocols: what they bring in practice.

Module 13 · Identity Federation with Microsoft Azure (1.5 h)

• Extending on-premises Active Directory to Azure.
• Implementing single sign-on with Azure for SaaS applications.
• Ensuring identity interoperability and portability across environments.

Module 14 · Federation with AWS and Multi-Cloud Interoperability (1.5 h)

• Amazon AWS federation: authenticating with Amazon IAM roles.
• Connecting a federated Microsoft identity to Amazon services and instances.
• Simplifying cross-system identity management with the SCIM protocol.

Module 15 · Identity Management for Mobility and BYOD (1.5 h)

• The specific IAM challenges of mobile devices and BYOD.
• Enrolling mobile devices using certificates.
• Configuring SCEP (Simple Certificate Enrollment Protocol), with examples using an MDM (Microsoft Intune) and network devices.

Module 16 · Wrap-up: Building a Comprehensive IAM Strategy (1.5 h)

• Review of the key building blocks covered during the course.
• Evaluation grid for an identity management solution in an enterprise, B2B or Internet context.
• Key success factors and common pitfalls of an IAM project.

Workshop Labs and Demos

• Workshop 1 — Exploiting protocol weaknesses
• Demo 2 — Simulating a Diffie-Hellman key exchange
• Workshop 3 — Installing and configuring an SSH server
• Workshop 4 — Using OpenSSL for secure exchanges
• Workshop 5 — Microsoft certificate store
• Workshop 6 — Deploying a Microsoft root certification authority
• Workshop 7 — Deploying a Microsoft intermediate certification authority
• Workshop 8 — Configuring and issuing a user certificate
• Workshop 9 — Certificate-based web authentication
• Workshop 10 — Secure email exchange
• Workshop 11 — Firefox web authentication and electronic signing of PDF and Word documents
• Workshop 12 — Smart card user enrollment by an enrollment agent
• Workshop 13 — Certificate archival and recovery
• Workshop 14 — Configuring SSO with ADFS
• Demo 15 — Installing and configuring Azure AD Connect
• Demo 16 — Using AWS SSO to integrate with Azure AD
• Demo 17 — AWS IAM federation with Azure AD
• Demo 18 — Configuring the Simple Certificate Enrollment Protocol (SCEP)