Authentication Concepts

This section covers important concepts and principles related to authentication and security.

Interactive Flows:

• 🔐 CIAM Flow Adventure - Choose-your-own-adventure guide through PKCE, OAuth 2.0, and SAML flows

Available Concepts:

• Auth Security Parameters - Mapping nonce, state, and PKCE to the threats they mitigate
• Strong Customer Authentication (SCA) - Regulatory requirements for secure authentication
• Understanding Password Matching with bcrypt and Salts - How bcrypt stores passwords, how salts kill rainbow tables, and why slow hashing matters
• Authentication vs Authorization - Understanding AuthN and AuthZ concepts
• Scopes vs. Claims - What scopes request and what claims return
• Standard Claims Reference - Complete guide to OIDC claims and how they interact
• Demystifying the Tokens - What each token does in the pipeline
• OpenID Connect Discovery Document - What .well-known/openid-configuration is and how clients use it
• ID Token vs. Access Token - What each token is for and how to use them
• JWT (JSON Web Tokens) - The structure, signing, and usage of JSON Web Tokens
• MFA Factors - Credentials, authenticators, and the three factor types: Knowledge, Possession, Inherence
• Authenticators: Independent vs Dependent - The standalone factors vs the fallbacks, plus the other ways to categorise them
• Authenticator Assurance Levels (AAL) - NIST AAL1/AAL2/AAL3: how confidence scales from single-factor to phishing-resistant