Auditing the authentication architecture: MFA, SSO and passwordless sign-in
You map the organisation’s authentication flows; you audit single sign-on, multi-factor coverage, legacy protocols, account recovery, session and token settings and conditional access, and write a roadmap towards passwordless sign-in.
Level 401 · 16 lessons · 15 practice labs
Lessons
Architecture
- Authentication flows: local, directory, federation
- Single sign-on: introduction to SAML and OpenID Connect
- Inventory of the identity provider and connected apps
- Short task: draw the fictional organisation’s authentication map
Auditing multi-factor authentication
- Measuring MFA coverage: which apps and accounts are left out
- Number matching and context against push fatigue
- Switching off legacy authentication protocols
- Do account recovery paths weaken MFA?
- Short task: find and close the MFA gaps in the lab identity provider
Sessions and tokens
- Session lifetimes and re-authentication
- Auditing token settings: signature, lifetime, audience
- Conditional access policies
- A migration plan to passwordless sign-in and passkeys
- Short task: fix the weak settings in the token configuration
Monitoring
- Monitoring authentication events
- Capstone: audit an organisation’s authentication architecture and write a roadmap
Practice labs
- Inventory the applications connected to the identity provider: Export the client registrations in the lab identity provider and record each app's protocol, owner and last use.
- Draw the authentication map of a fictional company: Identify Karaçam Mobilya's apps that use local, directory and federated login, and draw a map of which flow goes where.
- Find hidden logins that skip the identity provider: Find local admin logins outside single sign-on in the lab apps, add them to the inventory and write a plan to close them.
- Measure multi-factor authentication coverage: Count accounts without an enrolled second factor and apps that don't require one in the lab identity provider, and report the rate.
- Enable number matching for push approval and test it: Add number matching and location context to push approval in the lab identity provider and show that repeated prompts no longer work.
- Find and close MFA gaps in the identity provider: Find gaps caused by service accounts, exception groups and old clients, fix the policy and prove they are closed by measuring again.
- Find legacy authentication protocols: Detect plain-password protocols without second-factor support on the lab mail server and add them to the inventory.
- Disable the legacy protocol and verify the impact: Turn off the legacy protocol and prove the modern client still works while the old one can no longer connect.
- Audit whether account recovery paths weaken MFA: Review help-desk reset and backup-code flows in Turnalı Perakende's lab identity provider, fix the weak path and report it.
- Read session and token lifetimes and compare them with policy: Extract session, access and refresh token lifetimes from the lab identity provider and flag those exceeding company policy.
- Audit token signature, lifetime and audience settings: Decode the tokens the lab app accepts, find weak signature algorithm and audience-check settings and fix them.
- Test conditional access policies and close the gaps: Test location, device and risk-based lab policies with five scenarios, fix the policy that allows unexpectedly and record the results.
- Pick out suspicious logins from authentication events: Find unusual hours, countries and failed second-factor records in the lab identity provider's event log and write a short note.
- Write alert rules for authentication events: Write alert rules for repeated second-factor denials and impossible travel, and verify they fire on lab data.
- Audit the authentication architecture and write a roadmap: Prioritise the findings in Saklıvadi Üniversitesi's lab environment and prepare a phased roadmap leading to passkeys.
About this course
You map the organisation’s authentication flows; you audit single sign-on, multi-factor coverage, legacy protocols, account recovery, session and token settings and conditional access, and write a roadmap towards passwordless sign-in.
What you will learn
- Architecture
- Auditing multi-factor authentication
- Sessions and tokens
- Monitoring
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.