IAM Core
Identity pillar literacy — IdP, SSO, federation, lifecycle (joiner/mover/leaver) — identity architecture card on YOUR $ZT_LAB fictional org.
Visual · t40_identity_named
Identity pillar. $ZT_LAB. Original Cyberlium.
Identity is the primary ZT perimeter — name IdP, SSO, and lifecycle rows before device or network pillars on LAB-ZT-001.
Zero Trust identity pillar centers on centralized IdP (Okta, Entra ID, Ping literacy), SSO to apps, federation with partners, and automated JML provisioning/deprovisioning. Passwordless and phishing-resistant MFA are design targets — documented as checklist rows, not credential attack labs. Write identity architecture card on $ZT_LAB: IdP name (fictional), app integrations count, federation stub, JML workflow literacy. Next: MFA Conditional.
1. Identity components (named)
IdP: authoritative identity store + authentication. SSO: SAML/OIDC literacy to SaaS apps. Federation: B2B guest access with scoped trust. PAM: privileged access separate from standard IdP literacy.
Lifecycle: joiner/mover/leaver automation — orphan account = ZT gap.
Command guide
Try these commands — Identity components (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: CISA ZTMM Identity (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. LAB-ZT-001 identity stub
Fictional IdP: LabIdP.example.zt. Apps: HR SaaS, Dev Git, Finance ERP (fictional). Federation: one partner org stub with scoped groups.
Document identity as first pillar in architecture diagram footer.
3. Refusals
No credential stuffing labs, no real employee email imports, no employer tenant export without authorization.
Ship: identity architecture card. Next: MFA Conditional.
4. What you ship: identity architecture card
IdP + SSO + federation + JML rows for LAB-ZT-001. $ZT_LAB fictional only. chmod 600.
5. What you record before the next lesson
Date. Identity card. $ZT_LAB named. File t40-m03-l01-identity-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Import employer Entra export into lab. Teach password spraying as identity validation.
- Right: Write identity architecture card for fictional org. Next: MFA Conditional.
Mission: identity architecture card
1) Name fictional IdP and three app integrations. 2) Document JML workflow stub. 3) One federation partner row. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Deprovisioning speed matters as much as MFA — orphan accounts break ZT.
APPLY: Identity pillar on ZT includes:
APPLY: True or False: JML automation reduces orphan account risk.
APPLY: Identity card belongs on: