IAM: AWS, Active Directory, SSO & OAuth

Name: IAM: AWS, Active Directory, SSO & OAuth
Rating: 4.3 (20 reviews)

Master IAM with AWS, Active Directory, SSO, OAuth, MFA, and real-world security practices with hands-on labs

Created bySelfcode Academy

Last updated 4/2026

English

English [Auto],

What you'll learn

Students will learn to design secure IAM systems using RBAC, least privilege, and Zero Trust principles in real-world scenarios.
Students will learn to implement authentication systems using MFA, OAuth 2.0, OIDC, and SSO, and analyze tokens like JWT and SAML.
Students will learn to configure and manage enterprise IAM using Active Directory, including users, groups, and policies.
Students will learn to build and manage AWS IAM users, roles, and policies, including cross-account access and security controls.
Students will learn to identify and mitigate IAM security risks such as credential attacks and privilege escalation techniques.

Course content

8 sections • 57 lectures • 15h 29m total length

1.1 AAA model (Authentication, Authorization, Accounting)16:35
Explore the AAA framework—authentication, authorization, and accounting—covering multi-factor and risk-based authentication, common protocols, access control models (RBAC, ABAC, DAC, MAC), and the role of accounting logs in SIEM and SOAR.
1.2 Authentication practical12:08
Demonstrate authentication, authorization, and accounting (AAA) with Cisco Packet Tracer by configuring TACAS and RADIUS servers, managing credentials, and exploring privilege levels.
1.3 Identity, Credentials and accounts13:14
Describe how identity, accounts, and credentials form the core of access control, with identity as the digital representation, accounts enabling access, and credentials proving identity via authentication.
1.4 JML Process17:43
Learn how the joiner, mover, leaver process automates identity provisioning from HR data through SailPoint and Active Directory, enforcing least privilege and governance with PAM for elevated access.
1.5 Access Control models20:19
Explore how access control models regulate who can access what, including Bell-Lapadula and attribute-based access control. Learn rbac variants, discretionary access control, and risk-based access control within zero-trust environments.
1.6 Prcatical - RBAC design10:11
Learn practical RBAC design by modeling assets, actors, roles, and permissions in scenarios like hospital and SaaS. Build Excel-based policies with constraints and negative permissions before implementing in Active Directory.
1.7 Least Privilege16:18
Apply the least privilege principle across RBAC and ABAC, using just-in-time PAM, scope and time minimization, separation of duties, and governance to reduce attack surface.
1.8 Zero trust10:11
Apply zero trust by continually authenticating identity, device health, network origin, and application and data access, with implicit deny and micro-segmentation to limit lateral movement.
1.9 Practical - IAM policy design11:56
Design and document comprehensive IAM policies using RBAC and ABAC, applying it to hospital and SAS scenarios, covering policy structure, access requests, JML, and PAM.

2.1 Password storage and hashing part-127:20
2.2 Password hashing and storage Part-211:39
Discover how passwords are hashed and stored across Windows, Active Directory, Linux, and cloud IAM, and review hashes, storage files (sam, ntds.dit, etc/shadow), and algorithms (NTLM, bcrypt, Argon2, PBKDF2, SHA-512).
2.3 Practical- basic login in web app14:52
2.4 MFA types14:54
Explore the fundamentals of multifactor authentication, including TOTP and HOTP, push notification MFA, and QR based login. Examine FIDO2 passkeys and adaptive MFA for phishing-resistant, passwordless authentication.
2.5 Practical - MFA11:18
Implement a practical multi-factor authentication flow in a Flask app by setting up a local user database, hashing passwords, enrolling MFA with a QR code, and verifying TOTP codes.
2.6 OAuth 2.012:43
2.7 OIDC8:30
Explain how OpenID Connect adds an identity layer to OAuth 2.0 by using the authorization code flow, ID tokens (JWTs) and a nonce to prevent replay attacks.
2.8 Practical - Google oauth12:27
Demonstrate integrating Google OAuth into a Flask web app using Auth0 as the middleman, configuring credentials, redirect URIs, and test users to enable Google login.
2.9 Practical - TOTP generation10:54
Explore configuring time-based one-time passwords (TOTP) for multi-factor authentication using authenticator apps, linking a device via a QR code, and applying policy options like adaptive MFA or always-on MFA.
2.10 SSO Practical16:06
Explore how single sign-on enables one-time login to access multiple applications through central sessions and an identity provider, using Auth0 in a two-app setup.
2.11 JWT decoding and analysis12:41
Learn to decode and analyze JSON Web Tokens, inspect the header, payload, and signature, verify issuer and audience, and contrast ID tokens with access tokens in OAuth and OpenID Connect.

3.1 Installing Windows Server Part-112:20
Set up a Windows Server 2022 Active Directory lab by creating a VMware Workstation Pro environment, installing Windows Server 2022, and configuring a domain controller with mock users.
3.2 Installing Active Directory Part-28:27
Install and configure Active Directory on Windows Server, add roles and features, promote the server to a domain controller, and create a new forest for demo iam.local.
3.3 AD architecture11:48
Understand the Active Directory architecture, from forests and domains to organizational units and the global catalog, and how domain controllers, LDAP, Kerberos, DNS, and Group Policy centralize authentication and authorization.
3.4 Creating AD users and OUs24:30
Create organizational units and users in Active Directory, structure OUs for policy and delegation, and apply group policies. Follow naming conventions (agd lp, sam account name) for scalable iam.
3.5 Kerberos and NTLM22:08
Explore Kerberos and NTLM authentication in Active Directory, detailing TGT and service tickets, SPN, delegation types, and attacks like golden and silver tickets.
3.6 GPO creation30:52
3.7 GPO Exclusions18:06
Discover how to implement GPO exclusions using security filtering and deny permissions to exempt a single HR admin from a block on PowerShell, with a practical lab.
3.8 Privilege escalation in AD14:45
Explore how privilege escalation in active directory occurs through misconfigurations like nested group abuse, gpo misconfigurations, ou delegation abuse, and acl errors.
3.9 Practical - Authorization and ABE31:39
3.10 Practical - Sites and Subnets16:44
Discover how Active Directory sites and subnets optimize logon performance by directing clients to the nearest domain controller using subnet mappings, site definitions, and inter-site site links.
3.11 AD IAM11:05
Explore how Active Directory IAM unifies provisioning, authentication (Kerberos, NTLM), and authorization through groups, OUs, GPOs, and RBAC, within a tiered administration model for enterprise IAM.

4.1 Setting up AWS IAM17:50
Set up a free tier AWS account, enable MFA on the root user, and create an admin IAM user with administrator access for daily tasks.
4.2 IAM ecosystem comparsion15:43
4.3 IAM users, groups and roles part133:56
Explore IAM users, groups, and roles in this first part, within the AWS, Active Directory, SSO, and OAuth context.
4.4 Policies and trust policies19:27
Explore AWS IAM policies, including identity-based, resource-based, and trust policies; study policy anatomy (version, statement, effect, action, resource, conditions) and practice attaching policies to users, groups, and roles.
4.5 Breaking Policies16:48
Understand how overly permissive policies cause privilege escalation and data leakage, with pass rule abuse and wildcard resource risks, and learn mitigations like restricting roles and resources.
4.6 AWS Organisations and SCPs26:07
Explore AWS organizations to centralize multiple accounts, configure service control policies as guardrails, and perform a lab creating SCP policies for centralized governance and account management.
4.7 Same and Cross account access17:15
Explore same and cross account access in AWS IAM, using switch role and trust relationships to read S3 buckets across accounts with read-only permissions via the AWS CLI.
4.8 Authentication in aws20:33
Explore how AWS authenticates root users, IAM users, roles, and federated identities, using long-term, temporary credentials, MFA, and STS assume role to secure access and cross-account scenarios.
4.9 Mini Project8:23
Implement cross-account AWS access by creating a read-only S3 bucket role in the demo account and a dev user that can assume it via STS.

5.1 Federated vs Centralised identity13:09
Compare centralized identity with federated identity, showing how Active Directory manages credentials while identity providers like Auth0 enable single sign-on to AWS and other apps via SAML or OIDC.
5.2 SAML9:45
Understand what SAML is and how it enables single sign-on via a SAML assertion exchanged between identity providers and service providers.
5.3 Practical -Inspecting a SAML assertion28:30
5.4 SAML vs OIDC10:46
Compare SAML and OIDC from an IAM engineer perspective, detailing XML SAML assertions and JSON Web Tokens, enterprise SSO against cloud API usability, and practical configuration and debugging differences.
5.5 LDAP9:18
Learn how LDAP, the lightweight directory access protocol, serves as the querying backbone for Active Directory, enabling authentication via bind and federation with SAML and OIDC.
5.6 Practical - AD and AWS federation31:59

6.1 PAM vs IAM16:59
Compare PAM and IAM to reveal how privileged access management secures high-risk accounts through just-in-time and just-enough access, vault-based credential rotation, and continuous monitoring.
6.2 Practical - JIT access13:55
Implement just-in-time access across Active Directory, AWS, and federation with AD FS or Auth0, granting temporary domain admin or role access for one hour, with automation and audit logs.
6.3 Practical- Break Glass Accounts15:26
Explore break glass accounts as emergency, high-privilege credentials for privileged access management in IAM, AD, and AWS recovery. Learn secure handling, MFA, vault storage, rotation, and audit logging for crises.
6.4 Vaults and KMS22:04
Explore vaults and key management services to securely store and encrypt secrets with KMS and HSM. See KeePassXE for offline vaults and envelope encryption using data keys.
6.5 Practical- AWS Secret Manager20:04

7.1 Credential Stuffing14:31
Identify credential stuffing and password spraying in the authentication layer and harden defenses with adaptive multi-factor authentication, rate limiting, device fingerprinting, breached password detection, and strong password policies.
7.2 Kerberoasting14:00
Explore kerb roasting, a targeted IAM attack on service accounts in Active Directory, and learn defense with high-entropy random passwords, GMSA, PAM, and real-time detection.
7.3 Pass the Hash attack9:14
Learn how pass the hash attacks abuse NTLM hashes to impersonate users, and how to defend with Kerberos, deny NTLM, and protect LSAS using protected process light and credential guard.
7.4 Token Theft10:38
Explore token theft, how tokens stored in browsers and mobile apps can be stolen, and how device fingerprint, token binding, and continuous access evaluation defend IAM.
7.5 Shadow IT12:34
Learn how shadow IT threatens IAM security, with unapproved SaaS and shadow access, and how to tackle it through visibility, SSO, and controlled provisioning.

Requirements

Basic understanding of computers, users, and passwords is helpful, but no prior IAM or security experience is required.
Students will need a computer with internet access to perform hands-on labs using AWS, virtual machines, and web-based tools.
Familiarity with basic networking or IT concepts will help, but all key IAM and security concepts are explained from scratch.
No prior experience with Active Directory, AWS, or authentication protocols is required to start this course.
A willingness to learn through practical labs and real-world scenarios will help you gain the most value from this course.

Description

This course is designed to help you master Identity and Access Management (IAM) from both a practical and real-world perspective. Instead of focusing only on theory, this course combines core concepts, hands-on labs, and real-world scenarios to help you understand how IAM works in enterprise and cloud environments.

You will start with IAM fundamentals, including authentication, authorization, RBAC, least privilege, and Zero Trust. From there, you will dive deep into authentication mechanisms such as MFA, OAuth 2.0, OpenID Connect, SAML, and Single Sign-On (SSO). You will also work with tokens like JWT and understand how modern authentication systems operate.

The course then moves into enterprise IAM using Active Directory, where you will learn about domain controllers, Kerberos, NTLM, Group Policy Objects, and common security risks. You will also explore cloud IAM using AWS, including users, roles, policies, cross-account access, and organizational controls.

In addition, you will learn identity federation, privileged access management, and how to secure sensitive systems using vaults and just-in-time access. The course also covers real-world IAM attacks such as credential stuffing, pass-the-hash, and privilege escalation, along with detection and mitigation strategies.

By the end of this course, you will be able to design secure IAM architectures, implement authentication systems, and apply best practices used in real enterprise environments.

Who this course is for:

This course is for IT professionals who want to learn identity and access management and implement secure access control systems.
This course is for cybersecurity learners who want to understand authentication, authorization, and identity security in depth.
This course is for cloud engineers and DevOps professionals who want to work with AWS IAM, SSO, and identity federation.
This course is for students and job seekers who want to build practical IAM skills for roles in security and enterprise IT.
This course is for anyone interested in understanding how identity, authentication, and access control work in modern systems.

IAM: AWS, Active Directory, SSO & OAuth

What you'll learn

Explore related topics

Course content

IAM Fundamentals – Access Control, RBAC & Zero Trust9 lectures • 2hr 9min

Authentication Deep Dive – MFA, OAuth, SSO & JWT11 lectures • 2hr 33min

Enterprise IAM with Active Directory (AD, Kerberos, GPO)11 lectures • 3hr 22min

Cloud IAM with AWS – Policies, Roles & Cross-Account Access9 lectures • 2hr 56min

Identity Federation & SSO – SAML, OIDC & LDAP6 lectures • 1hr 43min

Privileged Access Management (PAM) – JIT, Vaults & Secrets5 lectures • 1hr 28min

IAM Security & Attacks – Credential Theft & Privilege Escalation5 lectures • 1hr 1min

Capstone Project – Design IAM Architecture for a Fintech Company1 lecture • 16min

Requirements

Description

Who this course is for: