Sign in Get started

Free course · 10 lessons · Intermediate

Authentication & Authorization Architecture

Design identity for modern systems: passwords and sessions, OAuth 2.0 and OIDC, tokens, MFA and passkeys, SSO, authorization models, multi-tenancy and service-to-service auth.

Start the course

1. Identity, Tokens and Access

How users prove who they are, how OAuth 2.0 and OpenID Connect work, and how sessions and tokens carry identity.

  1. Authentication Fundamentals — Passwords, sessions, factors and the threats every login system must handle.
  2. OAuth 2.0 and OpenID Connect — Delegated authorization with OAuth 2.0, login with OIDC, and the Authorization Code + PKCE flow.
  3. Sessions vs Tokens: JWTs, Cookies and Refresh Tokens — Choose between server-side sessions and self-contained tokens, and store them safely.
  4. Authorization Models: RBAC, ABAC and ReBAC — Model who can do what, from simple roles to attributes and relationships.

2. Strong Authentication and Federation

Phishing-resistant MFA and passkeys, single sign-on, and safe account recovery.

  1. MFA and Passkeys — Add multi-factor authentication and move toward phishing-resistant passkeys.
  2. Single Sign-On, Federation and Provisioning — Enterprise SSO with OIDC and SAML, plus SCIM user provisioning.
  3. Account Recovery and Abuse Prevention — Secure password resets, account takeover detection and login abuse controls.

3. Authorization at Scale

Multi-tenant isolation, centralized policy engines and service-to-service identity.

  1. Multi-Tenant Isolation — Keep each customer's data separate in shared infrastructure.
  2. Centralized Authorization and Policy Engines — Externalize authorization decisions with OPA, Cedar, OpenFGA and friends.
  3. Service-to-Service Authentication — Identity for workloads: client credentials, mTLS, workload identity and token exchange.