Identity and Access Management (IAM) Fundamentals

Step 1: Separate authentication, authorization, and accounting

Authentication proves who you are, with something you know such as a password, something you have such as a security key, or something you are such as a fingerprint. Authorization decides what you are allowed to do once your identity is known. Accounting, also called auditing, records what was done and by whom. Confusing authentication with authorization is behind many serious vulnerabilities.

Step 2: Manage the identity lifecycle

Accounts follow a joiner, mover, leaver lifecycle. When someone joins, create their access from a role template. When they change roles, add the new access and remove what they no longer need, which prevents privilege creep. When they leave, disable access immediately. Automate this from your HR or directory system where you can, and run periodic access reviews in which managers confirm that each person's permissions are still appropriate.

Step 3: Choose an access control model

Role-based access control, RBAC, grants permissions to roles, such as support agent or billing admin, and assigns people to roles, which is simple to audit. Attribute-based access control, ABAC, decides using attributes such as department, device health, location, and time, which is more flexible but harder to reason about. Whichever you use, apply least privilege, and use separation of duties so that one person cannot complete a high-risk process alone.

Role           Read orders  Refund  Edit prices  Manage users
-------------  -----------  ------  -----------  ------------
Support agent  yes          no      no           no
Billing admin  yes          yes     no           no
Catalog admin  yes          no      yes          no
IT admin       no           no      no           yes

Step 4: Protect privileged and non-human accounts

Administrator accounts and service accounts, which applications use to access other systems, are high-value targets. Give admins separate accounts for admin tasks, require strong MFA, grant elevated rights only when needed and for a limited time, and log everything. For service accounts, avoid long-lived shared passwords: use scoped credentials stored in a secrets manager and rotate them.

Step 5: Know the standards behind single sign-on

Single sign-on lets people authenticate once with an identity provider and access many applications. SAML is an older XML-based standard widely used for enterprise web single sign-on. OpenID Connect, OIDC, is built on OAuth 2.0, uses JSON, and issues an ID token proving who the user is, and it also suits mobile and single-page apps. SCIM is a different job: a REST protocol for provisioning and managing users and groups across systems, so accounts are created and removed automatically. SAML and OIDC handle authentication, and they are complementary to authorization frameworks like OAuth rather than competitors.