Beyond the Login
Understanding identity, one piece at a time.
Beyond the Login is an educational playground that will grow into a fully featured service. Our aim is to help you learn identity from the ground up, piece by piece, while developing marketable, real-world skills.
- How people, applications, and services establish identity and trust
- How access is granted, enforced, reviewed, and removed
- How protocols, policies, and security controls work together in practice
Identity is more than just a login. #
Consider the world around you. Identity is at the focal point of so much that we do: presenting a passport or identification card, entering a PIN or one-time password, badging into a workplace, or using biometrics to enter a secure area. Who you are, what you know, and what you possess can all play a part in how trust and access are established.
Every day, we rely on the way identity controls are implemented. As attackers use AI to expand their capabilities, getting identity right matters more than ever. For those of us designing, building, and securing these systems, understanding the decisions behind those controls is essential.
The identity landscape #
These are the areas we plan to explore. They overlap: understanding how they connect matters as much as understanding each one on its own.
What makes an identity trustworthy?
How identities are established and represented, and how credentials, keys, certificates, and public key infrastructure (PKI) support trust.
How do we prove who is connecting?
Authentication, multi-factor authentication (MFA), and single sign-on (SSO), including Kerberos, OpenID Connect, SAML, and WS-Federation.
What should that identity be allowed to do?
OAuth and delegated access, role-based access control (RBAC), attribute-based access control (ABAC), and the policies that govern and enforce access.
How should access change over time?
Directories, provisioning, SCIM, access reviews, and deprovisioning. Follow identities from their creation through changing responsibilities to the removal of access.
What about identities that aren’t people?
Applications, services, workloads, and AI agents need identities too. Explore how they authenticate and act with their own permissions or authority delegated by others.
How do we protect the trust we depend on?
Token and session security, credential protection, key rotation, and revocation. Understand what can go wrong and how to recognize, investigate, and prevent it.
From concepts to practice #
The goal is to make the details approachable without losing what makes them important. Lessons will connect clear explanations to practical examples you can follow, inspect, and change.
-
01
Understand the problem
Start with the question a technology or policy answers, the people and systems involved, and the trust between them.
-
02
See how it works
Follow a protocol exchange, inspect a credential, or trace an access decision. Connect each step to the concept behind it.
-
03
Put it into practice
Work through examples, change a configuration, and investigate failures. Learn both how to implement something and why it behaves the way it does.
A broad ambition, built one topic at a time
The site is taking shape, and lessons and interactive labs are still being planned. OAuth and OpenID Connect will be our first deep dives. From there, we’ll grow the material across the wider identity landscape.