IAM: AWS, Active Directory, SSO & OAuth

Name: IAM: AWS, Active Directory, SSO & OAuth
Rating: 3.9 (11 reviews)

Master IAM with AWS, Active Directory, SSO, OAuth, MFA, and real-world security practices with hands-on labs

Created bySelfcode Academy

Last updated 4/2026

English

English [Auto],

What you'll learn

Students will learn to design secure IAM systems using RBAC, least privilege, and Zero Trust principles in real-world scenarios.
Students will learn to implement authentication systems using MFA, OAuth 2.0, OIDC, and SSO, and analyze tokens like JWT and SAML.
Students will learn to configure and manage enterprise IAM using Active Directory, including users, groups, and policies.
Students will learn to build and manage AWS IAM users, roles, and policies, including cross-account access and security controls.
Students will learn to identify and mitigate IAM security risks such as credential attacks and privilege escalation techniques.

Course content

8 sections • 57 lectures • 15h 29m total length

1.1 AAA model (Authentication, Authorization, Accounting)16:35
1.2 Authentication practical12:08
Demonstrate authentication, authorization, and accounting (AAA) with Cisco Packet Tracer by configuring TACAS and RADIUS servers, managing credentials, and exploring privilege levels.
1.3 Identity, Credentials and accounts13:14
Describe how identity, accounts, and credentials form the core of access control, with identity as the digital representation, accounts enabling access, and credentials proving identity via authentication.
1.4 JML Process17:43
Learn how the joiner, mover, leaver process automates identity provisioning from HR data through SailPoint and Active Directory, enforcing least privilege and governance with PAM for elevated access.
1.5 Access Control models20:19
Explore how access control models regulate who can access what, including Bell-Lapadula and attribute-based access control. Learn rbac variants, discretionary access control, and risk-based access control within zero-trust environments.
1.6 Prcatical - RBAC design10:11
Learn practical RBAC design by modeling assets, actors, roles, and permissions in scenarios like hospital and SaaS. Build Excel-based policies with constraints and negative permissions before implementing in Active Directory.
1.7 Least Privilege16:18
Apply the least privilege principle across RBAC and ABAC, using just-in-time PAM, scope and time minimization, separation of duties, and governance to reduce attack surface.
1.8 Zero trust10:11
Apply zero trust by continually authenticating identity, device health, network origin, and application and data access, with implicit deny and micro-segmentation to limit lateral movement.
1.9 Practical - IAM policy design11:56
Design and document comprehensive IAM policies using RBAC and ABAC, applying it to hospital and SAS scenarios, covering policy structure, access requests, JML, and PAM.

2.1 Password storage and hashing part-127:20
2.2 Password hashing and storage Part-211:39
2.3 Practical- basic login in web app14:52
2.4 MFA types14:54
Explore the fundamentals of multifactor authentication, including TOTP and HOTP, push notification MFA, and QR based login. Examine FIDO2 passkeys and adaptive MFA for phishing-resistant, passwordless authentication.
2.5 Practical - MFA11:18
Implement a practical multi-factor authentication flow in a Flask app by setting up a local user database, hashing passwords, enrolling MFA with a QR code, and verifying TOTP codes.
2.6 OAuth 2.012:43
2.7 OIDC8:30
Explain how OpenID Connect adds an identity layer to OAuth 2.0 by using the authorization code flow, ID tokens (JWTs) and a nonce to prevent replay attacks.
2.8 Practical - Google oauth12:27
Demonstrate integrating Google OAuth into a Flask web app using Auth0 as the middleman, configuring credentials, redirect URIs, and test users to enable Google login.
2.9 Practical - TOTP generation10:54
Explore configuring time-based one-time passwords (TOTP) for multi-factor authentication using authenticator apps, linking a device via a QR code, and applying policy options like adaptive MFA or always-on MFA.
2.10 SSO Practical16:06
Explore how single sign-on enables one-time login to access multiple applications through central sessions and an identity provider, using Auth0 in a two-app setup.
2.11 JWT decoding and analysis12:41

3.1 Installing Windows Server Part-112:20
Set up a Windows Server 2022 Active Directory lab by creating a VMware Workstation Pro environment, installing Windows Server 2022, and configuring a domain controller with mock users.
3.2 Installing Active Directory Part-28:27
Install and configure Active Directory on Windows Server, add roles and features, promote the server to a domain controller, and create a new forest for demo iam.local.
3.3 AD architecture11:48
3.4 Creating AD users and OUs24:30
Create organizational units and users in Active Directory, structure OUs for policy and delegation, and apply group policies. Follow naming conventions (agd lp, sam account name) for scalable iam.
3.5 Kerberos and NTLM22:08
3.6 GPO creation30:52
3.7 GPO Exclusions18:06
Discover how to implement GPO exclusions using security filtering and deny permissions to exempt a single HR admin from a block on PowerShell, with a practical lab.
3.8 Privilege escalation in AD14:45
Explore how privilege escalation in active directory occurs through misconfigurations like nested group abuse, gpo misconfigurations, ou delegation abuse, and acl errors.
3.9 Practical - Authorization and ABE31:39
3.10 Practical - Sites and Subnets16:44
Discover how Active Directory sites and subnets optimize logon performance by directing clients to the nearest domain controller using subnet mappings, site definitions, and inter-site site links.
3.11 AD IAM11:05

4.1 Setting up AWS IAM17:50
4.2 IAM ecosystem comparsion15:43
4.3 IAM users, groups and roles part133:56
4.4 Policies and trust policies19:27
Explore AWS IAM policies, including identity-based, resource-based, and trust policies; study policy anatomy (version, statement, effect, action, resource, conditions) and practice attaching policies to users, groups, and roles.
4.5 Breaking Policies16:48
Understand how overly permissive policies cause privilege escalation and data leakage, with pass rule abuse and wildcard resource risks, and learn mitigations like restricting roles and resources.
4.6 AWS Organisations and SCPs26:07
Explore AWS organizations to centralize multiple accounts, configure service control policies as guardrails, and perform a lab creating SCP policies for centralized governance and account management.
4.7 Same and Cross account access17:15
4.8 Authentication in aws20:33
Explore how AWS authenticates root users, IAM users, roles, and federated identities, using long-term, temporary credentials, MFA, and STS assume role to secure access and cross-account scenarios.
4.9 Mini Project8:23

5.1 Federated vs Centralised identity13:09
5.2 SAML9:45
Understand what SAML is and how it enables single sign-on via a SAML assertion exchanged between identity providers and service providers.
5.3 Practical -Inspecting a SAML assertion28:30
5.4 SAML vs OIDC10:46
Compare SAML and OIDC from an IAM engineer perspective, detailing XML SAML assertions and JSON Web Tokens, enterprise SSO against cloud API usability, and practical configuration and debugging differences.
5.5 LDAP9:18
5.6 Practical - AD and AWS federation31:59

7.1 Credential Stuffing14:31
7.2 Kerberoasting14:00
Explore kerb roasting, a targeted IAM attack on service accounts in Active Directory, and learn defense with high-entropy random passwords, GMSA, PAM, and real-time detection.
7.3 Pass the Hash attack9:14
7.4 Token Theft10:38
Explore token theft, how tokens stored in browsers and mobile apps can be stolen, and how device fingerprint, token binding, and continuous access evaluation defend IAM.
7.5 Shadow IT12:34
Learn how shadow IT threatens IAM security, with unapproved SaaS and shadow access, and how to tackle it through visibility, SSO, and controlled provisioning.

Requirements

Basic understanding of computers, users, and passwords is helpful, but no prior IAM or security experience is required.
Students will need a computer with internet access to perform hands-on labs using AWS, virtual machines, and web-based tools.
Familiarity with basic networking or IT concepts will help, but all key IAM and security concepts are explained from scratch.
No prior experience with Active Directory, AWS, or authentication protocols is required to start this course.
A willingness to learn through practical labs and real-world scenarios will help you gain the most value from this course.

Description

This course is designed to help you master Identity and Access Management (IAM) from both a practical and real-world perspective. Instead of focusing only on theory, this course combines core concepts, hands-on labs, and real-world scenarios to help you understand how IAM works in enterprise and cloud environments.

You will start with IAM fundamentals, including authentication, authorization, RBAC, least privilege, and Zero Trust. From there, you will dive deep into authentication mechanisms such as MFA, OAuth 2.0, OpenID Connect, SAML, and Single Sign-On (SSO). You will also work with tokens like JWT and understand how modern authentication systems operate.

The course then moves into enterprise IAM using Active Directory, where you will learn about domain controllers, Kerberos, NTLM, Group Policy Objects, and common security risks. You will also explore cloud IAM using AWS, including users, roles, policies, cross-account access, and organizational controls.

In addition, you will learn identity federation, privileged access management, and how to secure sensitive systems using vaults and just-in-time access. The course also covers real-world IAM attacks such as credential stuffing, pass-the-hash, and privilege escalation, along with detection and mitigation strategies.

By the end of this course, you will be able to design secure IAM architectures, implement authentication systems, and apply best practices used in real enterprise environments.

Who this course is for:

This course is for IT professionals who want to learn identity and access management and implement secure access control systems.
This course is for cybersecurity learners who want to understand authentication, authorization, and identity security in depth.
This course is for cloud engineers and DevOps professionals who want to work with AWS IAM, SSO, and identity federation.
This course is for students and job seekers who want to build practical IAM skills for roles in security and enterprise IT.
This course is for anyone interested in understanding how identity, authentication, and access control work in modern systems.

IAM: AWS, Active Directory, SSO & OAuth

What you'll learn

Explore related topics

Course content

IAM Fundamentals – Access Control, RBAC & Zero Trust9 lectures • 2hr 9min

Authentication Deep Dive – MFA, OAuth, SSO & JWT11 lectures • 2hr 33min

Enterprise IAM with Active Directory (AD, Kerberos, GPO)11 lectures • 3hr 22min

Cloud IAM with AWS – Policies, Roles & Cross-Account Access9 lectures • 2hr 56min

Identity Federation & SSO – SAML, OIDC & LDAP6 lectures • 1hr 43min

Privileged Access Management (PAM) – JIT, Vaults & Secrets5 lectures • 1hr 28min

IAM Security & Attacks – Credential Theft & Privilege Escalation5 lectures • 1hr 1min

Capstone Project – Design IAM Architecture for a Fintech Company1 lecture • 16min

Requirements

Description

Who this course is for: