Identity & Access Management
Authentication, authorization, SSO, MFA, and identity governance.
Overview
IAM ensures only authorized users access resources.
Authentication Factors
| Factor | Example |
|---|---|
| Something you know | Password, PIN |
| Something you have | Token, smart card |
| Something you are | Fingerprint, face |
| Somewhere you are | Location |
| Something you do | Behavior patterns |
Multi-Factor Authentication
python
# TOTP Implementation
import pyotp
# Generate secret
secret = pyotp.random_base32()
totp = pyotp.TOTP(secret)
# Generate code
code = totp.now()
# Verify code
is_valid = totp.verify(code)
Authorization Models
Role-Based Access Control (RBAC)
roles:
admin:
- users: [create, read, update, delete]
- posts: [create, read, update, delete]
editor:
- posts: [create, read, update]
- comments: [read, delete]
viewer:
- posts: [read]
- comments: [read]
Attribute-Based Access Control (ABAC)
python
def check_access(user, resource, action):
if user.department == resource.department:
if action in user.permissions:
return True
return False
Single Sign-On (SSO)
SAML Flow
Architecture Diagram
1. User -> Service Provider (SP)
2. SP -> Identity Provider (IdP)
3. IdP -> User (authenticate)
4. User -> IdP (credentials)
5. IdP -> SP (SAML assertion)
6. SP -> User (access granted)
OAuth 2.0 Flows
Architecture Diagram
Authorization Code Flow:
1. User -> Client -> Authorization Server
2. Authorization Server -> User (login)
3. User -> Authorization Server (authorize)
4. Authorization Server -> Client (code)
5. Client -> Authorization Server (exchange code for token)
6. Authorization Server -> Client (access token)
Password Security
python
# Password hashing with bcrypt
import bcrypt
# Hash password
password = b"secure_password"
salt = bcrypt.gensalt()
hashed = bcrypt.hashpw(password, salt)
# Verify password
if bcrypt.checkpw(password, hashed):
print("Password matches")
Identity Governance
- Access Reviews â Regular audits
- Provisioning â Automated account management
- Compliance â Regulatory adherence
- Reporting â Access analytics
Practice
Implement MFA and SSO for a web application.