Who this is for. Engineers who build sign-in, single sign-on or service-to-service security, and anyone who has met the pieces over the years and wants them in order. No prior identity experience assumed.
How to use it. Start with the Primer, then read Identity & Access for who is the user and Authorisation for what may they do. Each deck is a self-contained Reveal.js presentation with a Markdown version.
The reading order
- Start here
01 · 1 entry
- Identity & Access
02–08 · 7 entries
- Authorisation
09–11 · 3 entries
Part 1 · 01Start here
The map of the field: history, threats, standards and the reading roadmap.
- 01Identity & Authorisation — A Primer →
The gateway deck: why these problems exist, the four eras (mainframe, web, mobile and cloud, agent and wallet), the AuthN and AuthZ maps, the standards bodies, threats and their defences, build or buy, the regulatory backdrop, and a reading roadmap to the decks below
Part 2 · 02–08Identity & Access
Who is the user, and how do they prove it to other systems? Authentication primitives, then the federation stacks that carry identity.
- 02Authentication Methods →
Establishing who the user is: Argon2id hashing and NIST 800-63B policy, credential stuffing, factor classes and the AAL ladder, TOTP/HOTP, SMS, email and push trade-offs, WebAuthn, FIDO2 and passkeys, attestation, account recovery and risk-based auth
- 03OAuth — A Gentle Primer (Part 0) →
No RFCs, no code: the valet-key mental model, AuthN against AuthZ, the password-sharing problem, "Sign in with Google" walked through, tokens, scopes and the MCP angle. Read first if delegated auth is new
- 04Introduction to OAuth (Part 1) →
Interactive presentation on OAuth — purpose, history, OAuth 1.0a → 2.0 → 2.1, all grant types, PKCE, OpenID Connect, JWTs, DPoP/mTLS, BCP 240 attacks & defences, library and flow selection
- 05OAuth for MCP Servers (Part 2) →
OAuth for the Model Context Protocol: the MCP authorisation profile, Resource Indicators, DPoP, the Docker MCP Gateway as an OAuth broker, and a tour of commercial and open-source identity providers
- 06Introduction to OpenID Connect →
OIDC foundations: the ID token on top of OAuth, JWT validation, discovery and JWKS rotation, UserInfo, response types, logout, CIBA, OpenID Federation, FAPI 2.0, real-world provider quirks and workload OIDC for CI/CD
- 07Advanced OpenID Connect →
The deep end: validation edge cases, PAR / JAR / JARM, FAPI 2.0, sender-constrained tokens, Token Exchange, OpenID Federation trust chains, eIDAS 2.0 and the EUDI wallet stack (SIOPv2, OpenID4VCI, OpenID4VP, ISO mDL) and migration playbooks
- 08SAML 2.0 & SCIM →
The parallel enterprise stack: SAML roles, metadata, SSO flows, bindings and assertion validation, SAML attacks and defences, SAML against OIDC, SCIM 2.0 provisioning and group sync, IdP quirks and a B2B enterprise-readiness checklist
Part 3 · 09–11Authorisation
What may the user or workload do, and where is it enforced? Foundations, then east-west service-to-service, then north-south at the edge.
- 09Authorization Models →
The decision layer: PEP/PDP/PAP/PIP, the DAC → MAC → RBAC → ABAC → ReBAC arc, Cedar, Zanzibar and relationship tuples, policy-as-code engines compared (OPA, Cedar, OpenFGA, SpiceDB, Casbin), caching, audit and migration
- 10Workload Identity & Service-Mesh AuthZ →
East-west authorisation: SPIFFE and SPIRE, service-mesh AuthZ in Istio, Linkerd and Cilium, mTLS at scale, cloud workload identity (IRSA, GCP and Azure), Kubernetes projected tokens, and workload identity for AI agents and MCP servers
- 11Edge & Gateway AuthZ →
North-south authorisation: JWT against introspection at the edge, Envoy
ext_authz, API-gateway authorisers, Cloudflare Access, rate limits as policy, Token Exchange at the edge, GraphQL and webhook patterns, and the MCP Gateway as the AI-era edge