Cloud Security Engineering

MODULE 01 — FOUNDATION & IDENTITY SETUP

Sessions 01–06

Cloud Fundamentals
Cloud computing basics; service models overview — IaaS, PaaS, SaaS (concepts only, no hands-on).

Cloud Account & VM Setup
Create AWS / Azure / GCP account; provision a Virtual Machine.

VM Access
Connect to the VM via SSH (Linux) or RDP (Windows) using its Public IP.

Identity Foundations
Identity in the Cloud Era — why identity is the new perimeter, cloud security triad, course map and careers.

Okta Platform & Tenancy
Editions/products, Workforce vs Customer Identity, tenant anatomy, and creation of a free Okta Developer org.

Universal Directory
Manual user creation, profile attributes, user states, password/authenticator basics.

Groups, Rules & Admin Roles
Group strategy, rule-based membership, admin role types, and least privilege.

LAB 01 — IDENTITY WORKSPACE BUILD

Build a personal Okta org with:

• 5 users
• 3 rule-based groups
• 2 admin roles assigned
• CSV import drill
• Error-fix log
• Test sign-in verification

Day 6 — Drill + Quiz
CSV bulk import with 20 users, fix 3 errors, Quiz 1 with 10 questions, and credential-stuffing case study.

MODULE 02 — AUTHENTICATION ARCHITECTURE & SAML BASICS

Sessions 07–12

Authentication vs Authorization
Password sprawl, shadow accounts, why organizations centralize identity, authentication vs authorization vs federation, and the delegated-authentication model.

LDAP & AD Concepts
Directory services conceptually, DIT structure, bind and search basics, and where on-prem AD fits in the identity chain.

SAML 2.0 Anatomy — Assertions
Assertion structure including Issuer, NameID, Subject, Conditions, AudienceRestriction, AttributeStatement and AuthnStatement.

SAML Bindings, Metadata & Trust
HTTP-Redirect vs HTTP-POST bindings, IdP & SP metadata XML, ACS URL, Entity ID/Audience, SSO endpoints and signing certificates.

SP-Initiated vs IdP-Initiated Flows
Both SSO journeys step by step, RelayState, deep linking, unsolicited responses and associated risks.

LAB 02 — TRACE A COMPLETE SSO FLOW

Run SP-initiated login against samltest.id → capture AuthnRequest + Response in SAML-tracer → decode Base64 XML → label every assertion field → export and annotate the trace for the portfolio.

Day 6 — Quiz & Mystery Assertion Drill
10-question quiz + identify subject, expiry and attributes in a mystery assertion within 5 minutes.

MODULE 03 — SAML WITH OKTA: DEEP DIVE

Sessions 13–18

OIN Apps
OIN catalogue apps vs Create App Integration wizard vs Template apps.

SAML App Configuration
ACS/Audience/Entity ID fields in the Okta UI, metadata download/import, assigning users and groups, and dashboard verification.

Attributes, Claims & NameID
Attribute statements, group attribute statements, NameID formats, profile-driven attribute mapping and transformation pitfalls.

Sign-On Policies & Flow Control
App sign-on policies, group-based access, authentication policies, authenticator chains, session behaviour and bookmark apps.

Browser-Based SAML Debugging
SAML-tracer filtering, request/response decoding, signature vs content, and expected vs received attribute comparison.

Assertion Security & Tampering Awareness
XML signatures, what they protect, unsigned assertions, certificate rollover basics and controlled protocol-validation testing.

LAB 03 — BUILD · BREAK · FIX SAML APP

Configure a custom SAML app from scratch → map 5 attributes → capture a clean trace → diagnose 2 instructor-injected faults → repair the configuration → complete a working green login.

Day 6 — Quiz + Mystery Assertion Drill
10-question quiz + identify subject, expiry and attributes within 5 minutes.

MODULE 04 — OAUTH 2.0 + OPENID CONNECT

Sessions 19–24

Why OAuth Exists
Authorization vs authentication, OAuth actors, resource owner, client, authorization server, resource server and the “Login with Google” model.

Grant Types & PKCE
Authorization Code flow, PKCE, Client Credentials, why Implicit is deprecated, and choosing the correct grant.

Tokens Deep Dive
Access, ID and refresh tokens; JWT anatomy; iss, sub, aud, exp and scopes; token lifetimes and refresh rotation.

Okta Authorization Servers
Org vs custom authorization servers, scopes, claims, access policies, rules and token preview.

OIDC Layer & Modern SSO
id_token, userinfo endpoint, discovery document, nonce, replay protection and SAML vs OIDC.

LAB 04 — RUN OAUTH/OIDC END-TO-END

Create an OIDC app in Okta → execute Auth Code + PKCE flow in OIDC Debugger → decode id_token on jwt.io → repeat through Postman GUI → test a client-credentials call.

Day 6 — Quiz + Token Validation Drill
10-question quiz + determine whether a token is valid for a given API using aud, scope and exp.

MODULE 05 — ENCRYPTION, MFA & SINGLE LOGOUT

Sessions 25–30

X.509 Certificates & RSA Key Pairs
Certificate fundamentals, RSA key pairs and OpenSSL one-line commands for generating keys, creating certificates and inspecting fingerprints.

Encrypted SAML Assertions
Signing vs encryption, enabling assertion encryption in Okta, encryption certificate upload and encrypted-flow validation.

MFA Factors & Policies
Okta Verify, number challenge, TOTP, SMS/Email, authenticator enrollment policies, factor sequencing and entry-point policies.

Passwordless — FIDO2 / Passkeys
WebAuthn ceremony, platform vs roaming authenticators, phishing resistance, passkey enrollment and workforce rollout patterns.

SAML Single Logout & Sessions
SP-initiated vs IdP-initiated logout, SLO URL configuration, session lifetime rules and logout troubleshooting.

LAB 05 — HARDENED LOGIN END-TO-END

Enable encrypted assertion → enroll Okta Verify + TOTP + one passkey → configure SLO → run the complete login → MFA → work → logout journey → verify session termination in the System Log.

Day 6 — Quiz + SLO Troubleshooting Drill
10-question quiz + investigate why users remain logged in after logout.

MODULE 06 — SCIM + LIFECYCLE PROVISIONING

Sessions 31–36

JML Model
Joiner, Mover and Leaver concepts, manual provisioning challenges, orphan-account risk, birthright access, role transitions and instant deprovisioning.

SCIM 2.0 Protocol Anatomy
Users & Groups resources, create/update/deactivate operations, attribute schemas, mappings and bearer-token authentication.

Okta Provisioning Configuration
Configure API Integration, Base URL + token, Create Users, Update Attributes, Deactivate toggles, attribute mapping, import/push directions and sync scheduling.

Group Push, Assignment Rules & Profile Sourcing
Group push, assignment rules, profile sourcing priority, attribute conflict resolution and downstream application verification.

No-Code Automation with Okta Workflows
Build automation using trigger → action cards.

Automation 1: Deactivated user → revoke sessions + notify channel.
Automation 2: Group membership → automatically assign application birthright.

LAB 06 — JOINER · MOVER · LEAVER AUTOMATION

Connect SCIM test app → configure create/update/deactivate → map 6 attributes → group-push a team → run JML simulation → capture System Log proof.

Day 6 — Quiz + Provisioning Troubleshooting Drill
10-question quiz + identify why a user who left the organization still has access.

MODULE 07 — AD / ENTRA ID INTEGRATION

Sessions 37–42

Hybrid Identity Patterns
Directory of record decisions, source-of-truth models, Okta’s position between on-prem HR/AD and cloud applications, and migration strategies.

Okta AD Agent & Delegated Authentication
AD Agent concept, installation flow, JIT import, delegated authentication and LDAP interface basics.

Entra ID — Identity Side Tour
Free Entra tenant walkthrough focused on identity blades, users, enterprise apps and SSO configuration.

Okta → AWS Identity Center Pattern
Metadata exchange, enterprise application configuration, ACS/Entity URLs, group assignment and round-trip testing.

SAML + SCIM Enterprise Integration
Okta-side application configuration, ACS/Audience configuration and provisioning token setup.

LAB 07 — FEDERATION ROUND-TRIP

Federate Okta with a second IdP using Entra free tenant or Keycloak → metadata exchange → claim mapping → external directory login → verify assertion attributes and System Log evidence.

Day 6 — Quiz + Federation Troubleshooting Drill
10-question quiz + identify a missed group assignment causing an M365 login issue.

MODULE 08 — IDENTITY BROKERS & CRYPTOGRAPHY

Sessions 43–48

Federation
Mergers & acquisitions, B2B partner access, multi-IdP enterprises, the federation n² problem and how identity brokers simplify enterprise trust relationships.

Inbound vs Outbound Federation
Okta as IdP vs Okta as broker, IdP routing rules, Just-In-Time provisioning, account linking and inbound claim transformation.

Keycloak — Free Second IdP
Keycloak realm and client tour, SAML/OIDC/LDAP concepts, creating users and using Keycloak as a second identity provider.

Broker Chain Live Build
Keycloak user → SAML/OIDC bridge into Okta → access to an Okta-fronted application → metadata exchange → claim mapping → routing verification.

Cryptography for Identity Engineers
SHA-256 fingerprints, symmetric vs asymmetric cryptography, RSA key pairs, digital signatures and hybrid encryption using OpenSSL tools.

LAB 08 — IDENTITY BROKER + SIGNATURE MASTERY

Build a Keycloak ↔ Okta broker → map claims → generate RSA pair → sign a message → verify it with OpenSSL → connect signature verification to SAML assertion security.

Day 6 — Quiz + Certificate Troubleshooting Drill
10-question quiz + diagnose a federation failure caused by a partner certificate change.

MODULE 09 — IAM TROUBLESHOOTING

Sessions 49–54

Evidence-Based Troubleshooting Method
Reproduce → capture → compare → isolate → fix → verify.

Okta System Log
Filtering actor/target/event types, correlation IDs, health checks and diagnostic decision trees.

SAML Failure Matrix

• ACS/Audience mismatch
• Entity ID drift
• NameID format errors
• Missing/wrong attributes
• RelayState loss
• Clock skew
• Expired certificates
• Certificate rollover
• Signature algorithm mismatch
• Unsigned assertion rejection
• POST binding issues

OAuth / OIDC Failure Matrix

• redirect_uri mismatch
• invalid client_id/secret
• scope rejection
• audience mismatch
• expired tokens
• refresh failures
• PKCE failures

Provisioning / SCIM Failure Matrix

• Invalid SCIM token
• Endpoint reachability
• Attribute mapping conflicts
• Group-push mismatches
• Duplicate user creation
• Failed deactivation
• System Log provisioning events

LAB 09 — 3 TIMED ERROR HUNTS + TROUBLESHOOTING PLAYBOOK

Instructor injects 3 failures across SAML + OIDC + SCIM → student gets 15 minutes for each issue → capture evidence → identify root cause → fix the issue → document the incident.

Final deliverable: Student-authored Troubleshooting Playbook covering 15+ known failures.

Day 6 — Quiz + Interview Sprint
10-question quiz + answer: “SSO broken across 500 users — what are your first 3 checks?”

MODULE 10 — MEGA CAPSTONE & CERTIFICATION

Sessions 55–60

Capstone Scenario — NovaCorp

Scenario: “NovaCorp — 3 business units, contractors, partner organization.”

Students receive requirements for:

• SAML application
• OIDC application
• SCIM lifecycle
• MFA & Passkeys
• Single Logout
• Encrypted assertions
• One federation hop
• Audit trail

Build Day 1 — Identity Core

SAML + OIDC tenant structure, groups/rules, protocol applications, attribute mapping and evidence screenshots.

Build Day 2 — Security Layer

MFA + Passkeys, encrypted assertions, adaptive MFA, passkey enrollment, sign-on policies, session policies and SLO.

Build Day 3 — Lifecycle & Federation

SCIM provisioning, JML automation using Workflows, Keycloak partner federation and System Log evidence.

Demo Day + Defense + Gauntlet

10-minute show-and-prove per student covering live login, lifecycle and logout.

Students then complete a troubleshooting gauntlet with 3 injected errors.

Final Assessment + Certification

Scenario-based assessment covering design and debugging.

Successful students receive the Cyvero Certificate of Completion.

CAPSTONE PASS CRITERIA

The final NovaCorp identity stack must include:

• SAML App
• OIDC App
• SCIM Lifecycle
• MFA / Passkeys
• Single Logout
• Federation Hop
• Live Defense with Log Evidence

Minimum Requirements

• All 6 components working
• Defense questions answered
• Minimum 2 out of 3 gauntlet challenges completed
• 80% lab evidence submitted

OUTCOMES & CAREER TRACKS

Student Portfolio Includes

• NovaCorp Capstone
• Troubleshooting Playbook
• 9 Lab Evidence Packs
• Annotated SAML Protocol Traces
• Decoded JWT / OIDC Flows
• Cyvero Certificate of Completion

Career Tracks — India Market

Freshers → Entry IT / Support

• IAM/SSO Support Engineer
• Okta / Junior IAM Admin
• Identity Operations Analyst in GCCs

System Administrators / Helpdesk / NOC Profiles

Build IAM-focused skills through SAML, OAuth and SCIM.

Experienced → Architect Track

IAM Engineer → Senior IAM / IAM Architect.

PROOF VALUE

• Live-demoable portfolio project for interviews
• Scenario-based interview answer bank
• Verifiable hands-on claims for resumes
• Protocol-level identity knowledge
• Cyvero program credential