Zero › Module 3 › Lesson 1
IAM Core
Identity pillar literacy — IdP, SSO, federation, lifecycle (joiner/mover/leaver) — identity architecture card on YOUR $ZT_LAB fictional org.
Visual · t40_identity_named
Identity pillar. $ZT_LAB. Original Cyberlium.
Opening
Identity is the primary ZT perimeter — name IdP, SSO, and lifecycle rows before device or network pillars on LAB-ZT-001.
Zero Trust identity pillar centers on centralized IdP (Okta, Entra ID, Ping literacy), SSO to apps, federation with partners, and automated JML provisioning/deprovisioning. Passwordless and phishing-resistant MFA are design targets — documented as checklist rows, not credential attack labs. Write identity architecture card on $ZT_LAB: IdP name (fictional), app integrations count, federation stub, JML workflow literacy. Next: MFA Conditional.
1. Identity components (named)
IdP: authoritative identity store + authentication. SSO: SAML/OIDC literacy to SaaS apps. Federation: B2B guest access with scoped trust. PAM: privileged access separate from standard IdP literacy.
Lifecycle: joiner/mover/leaver automation — orphan account = ZT gap.
Command guide
Try these commands — Identity components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM Identity — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_IDENTITY=${ZT_IDENTITY:-$ZT_LAB/LAB-ZT-001/identity}
curl -sS https://www.cisa.gov/zero-trust-maturity-model | head -10
cat > "$ZT_IDENTITY/identity-architecture-card.md" <<'EOF'
# Identity Architecture Card — LAB-ZT-001
- **IdP (fictional):** LabIdP.example.zt
- **SSO:** SAML/OIDC to HR, Git, Finance SaaS (fictional)
- **Federation:** Partner org B2B guest — scoped group Partner-Readonly
- **JML:** automated provision/deprovision — 24h leaver SLA literacy
- **PAM link:** separate vault for U-004/U-005 admin paths
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'IdP|JML|PAM|LAB SAMPLE' "$ZT_IDENTITY/identity-architecture-card.md"
Primary tools to practice this lesson: curl, grep. Reference sites: CISA ZTMM Identity (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. LAB-ZT-001 identity stub
Fictional IdP: LabIdP.example.zt. Apps: HR SaaS, Dev Git, Finance ERP (fictional). Federation: one partner org stub with scoped groups.
Document identity as first pillar in architecture diagram footer.
3. Refusals
No credential stuffing labs, no real employee email imports, no employer tenant export without authorization.
Ship: identity architecture card. Next: MFA Conditional.
4. What you ship: identity architecture card
IdP + SSO + federation + JML rows for LAB-ZT-001. $ZT_LAB fictional only. chmod 600.
5. What you record before the next lesson
Date. Identity card. $ZT_LAB named. File t40-m03-l01-identity-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import employer Entra export into lab. Teach password spraying as identity validation.
Right
Write identity architecture card for fictional org. Next: MFA Conditional.
Mission: identity architecture card
1) Name fictional IdP and three app integrations. 2) Document JML workflow stub. 3) One federation partner row. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Deprovisioning speed matters as much as MFA — orphan accounts break ZT.
Knowledge Check
APPLY: Identity pillar on ZT includes:
Multiple choice
Knowledge Check
APPLY: True or False: JML automation reduces orphan account risk.
True or False
Knowledge Check
APPLY: Identity card belongs on:
Multiple choice