IC LogoIAMCOURSES

PingFederate

Enterprise Learning Roadmap

A progressive, hands-on roadmap from an absolute beginner to an Enterprise IAM Architect using Docker-based Proof of Concepts (POCs).

Track 0 — Foundations

Track 1 — Authentication

  • Local Users— Datastores & local user profiles (coming soon)
  • LDAP Authentication— Integration with Active Directory/LDAP directory servers (coming soon)
  • Active Directory— AD, domain-joining, integrated authentication (coming soon)
  • Kerberos— Windows SSO implementation (coming soon)
  • Password Policies— Custom password rules and expiration (coming soon)
  • MFA— Step-up authentication routing (coming soon)
  • Selectors— Authentication selectors (coming soon)
  • Authentication Failures— Error page customization and error mapping (coming soon)

Track 2 — OAuth 2.0 & OIDC

  • OAuth Fundamentals— Roles, endpoint types, and standard endpoints (coming soon)
  • Authorization Code— Standard web flow implementation (RFC 6749) (coming soon)
  • PKCE— Proof Key for Code Exchange for SPAs & mobile apps (RFC 7636) (coming soon)
  • Client Credentials— Machine-to-machine integration (coming soon)
  • Refresh Tokens— Understanding the token lifecycle and rotation (coming soon)
  • JWT— JSON Web Tokens structure, validation, and metadata (RFC 7519) (coming soon)
  • ID Token— OpenID Connect identity assertion structure (coming soon)
  • Discovery— OpenID Connect Discovery Metadata endpoint (.well-known) (coming soon)
  • UserInfo— Retrieving user claims from the UserInfo endpoint (coming soon)
  • Dynamic Client Registration— Automating client creation (RFC 7591) (coming soon)

Track 3 — SAML

  • SAML Basics— Assertions, Protocols, and XML schemas (coming soon)
  • IdP Configuration— Importing and exporting SAML Metadata (coming soon)
  • SP Connection— Setting up service provider federation (coming soon)
  • Attribute Mapping— Attribute contract fulfillment in assertions (coming soon)
  • SLO— Single Logout profiles (Front-channel vs Back-channel) (coming soon)
  • Certificates— Signing, encryption, and certificate pinning (coming soon)

Track 4 — Tokens & Claims

  • Access Token Managers— Configuring ATM instances (coming soon)
  • Claim Mapping— Token attribute contract fulfillment (coming soon)
  • Token Lifetime— Expiration strategies and token validation (coming soon)
  • Custom Claims— Generating complex claims using OGNL expressions (coming soon)
  • Signing Keys— Dynamic JWKS endpoints and key rotation (JWK) (coming soon)
  • Token Introspection— Validating tokens at the authorization server (RFC 7662) (coming soon)
  • Token Revocation— Revoking access and refresh tokens (RFC 7009) (coming soon)

Track 5 — Enterprise Design

  • Multiple OAuth Clients— Scaling client management (coming soon)
  • Customer vs Workforce— Configuring separated identity domains (coming soon)
  • Shared Authentication— Reusing adapters across multiple connections (coming soon)
  • Multiple ATMs— Shaping tokens for different downstream resource servers (coming soon)
  • Authentication Branching— Complex policy decisions (group/IP-based checks) (coming soon)
  • Session Management— Cookie control, absolute vs idle timeouts, SSO sessions (coming soon)
  • Logout Strategies— Coordinating global logout sessions (coming soon)

Track 6 — API & M2M

  • Service Accounts— Hardening Client Credentials clients (coming soon)
  • Token Exchange— Exchanging tokens for internal microservices (RFC 8693) (coming soon)
  • API Protection— Securing APIs using PingFederate and API Gateways (coming soon)
  • OAuth Scopes— Designing dynamic authorization scopes (coming soon)
  • Audience Restriction— Restricting tokens to target resource servers (coming soon)
  • Delegation— On-Behalf-Of workflows for multi-tier API environments (coming soon)

Track 7 — High Availability

  • Clustering— Dynamic vs Static clustering configurations (JGroups) (coming soon)
  • Load Balancing— Reverse proxying and distributing client traffic (coming soon)
  • Session Replication— Replicating sessions across cluster engine nodes (coming soon)
  • Certificate Rotation— Graceful rollover of signing and decryption certs (coming soon)
  • Backup & Restore— Exporter, archive configs, and automated recovery (coming soon)

Track 8 — Enterprise Migration

  • Inventory— Discovering and cataloging legacy SAML/OAuth configurations (coming soon)
  • OAuth Client Classification— Identifying migration categories (coming soon)
  • SAML Connection Inventory— Cataloging partners, bindings, and certificates (coming soon)
  • Dependency Analysis— Tracing policies, custom adapters, and ATMs (coming soon)
  • Shared Components— Identifying candidates for reuse (coming soon)
  • Customer Tenant— Designing isolated customer setups (coming soon)
  • Workforce Tenant— Designing isolated workforce setups (coming soon)
  • Tenant Split— Migrating configuration segments (coming soon)
  • Parallel Run— Side-by-side execution strategies (coming soon)
  • Fallback & Rollback— De-risking cutovers with clear rollbacks (coming soon)

Track 9 — Architect Labs

  • Enterprise Reference Architecture— End-to-end IAM topology design (coming soon)
  • Banking IAM Patterns— Open Banking, PSD2, and FAPI compliance (coming soon)
  • Multi-Tenant Design— Scaling single instances for multiple customers (coming soon)
  • Zero Trust Integration— Real-time risk scoring and continuous auth (coming soon)
  • Performance & Scaling— Load testing, heap settings, and thread tuning (coming soon)
  • Security Hardening— TLS cipher suites, HTTP headers, secret managers (coming soon)
  • Operational Runbook— Health checks, Prometheus metrics, and log pipelines (coming soon)
  • Disaster Recovery— Active-Active cross-region replication (coming soon)
  • End-to-End Enterprise Implementation— Delivering a production-ready environment (coming soon)
  • Architect Challenge— Designing and reviewing custom topologies (coming soon)
NextInstall PingFederate: Standalone ZIP Setup & License Activation