Identity Engineering

Domain Framework v0.4

Working Domain Framework — the authoritative owner-provided specification.

Identity Engineering Domain Framework v0.4

1. Purpose

A Question-Driven Knowledge Framework for learning, researching, building, and securing Identity Systems, gradually evolving into a Living Identity Engineering Textbook.

Core Principles

  • Question-Driven Learning: Start with real-world engineering questions to discover what needs to be learned.
  • Domain-Based Knowledge Organization: Organize discovered knowledge into clearly defined Identity Engineering domains.
  • One Knowledge Base: Maintain a unified and reusable knowledge repository.
  • Two Career Learning Tracks: Support Identity Platform / CIAM Engineering and Enterprise IAM / PAM / IGA Engineering.
  • Engineering Depth: Cover technical concepts, mechanisms, architecture, implementations, and security considerations.
  • Hybrid Vendor Coverage: Combine vendor-neutral fundamentals with vendor-specific technologies and solutions.
  • Progressive Knowledge Building: Expand the knowledge framework as new topics are discovered.
  • Living Textbook: Gradually transform accumulated knowledge into structured learning materials and curricula.

2. Knowledge Domains

D01 — Identity Fundamentals

Scope: Fundamental concepts underlying digital identity and access management.

Key Knowledge Areas:

  • Digital Identity
  • Identity Subjects
  • Human Identity vs Non-Human Identity
  • Principals, Accounts, and Credentials
  • Identity Attributes and Identifiers
  • Identity Types and Contexts
  • Identity Lifecycle
  • Trust Boundaries
  • Identity Ownership

D02 — Authentication

Scope: Technologies and mechanisms used to verify identities.

Key Knowledge Areas:

  • Password Authentication
  • Multi-Factor Authentication (MFA)
  • Passwordless Authentication
  • Passkeys
  • FIDO2 and WebAuthn
  • Windows Hello / Windows Hello for Business
  • Smart Cards and PIV
  • Certificate-Based Authentication
  • Authentication Factors and Authenticators
  • Authentication Assurance
  • Authentication Recovery

D03 — Authorization & Access Control

Scope: Mechanisms for determining, granting, and enforcing access permissions.

Key Knowledge Areas:

  • Access Control Lists (ACL)
  • Role-Based Access Control (RBAC)
  • Attribute-Based Access Control (ABAC)
  • Relationship-Based Access Control (ReBAC)
  • Policy-Based Access Control
  • Policy Decision Points (PDP)
  • Policy Enforcement Points (PEP)
  • Authorization Policy Engines
  • Delegated Authorization
  • Least Privilege
  • Fine-Grained Authorization

D04 — Identity Protocols & Cryptography

Scope: Standards, protocols, and cryptographic mechanisms supporting identity systems.

Key Knowledge Areas:

  • OAuth 2.0
  • OpenID Connect (OIDC)
  • SAML 2.0
  • Kerberos
  • LDAP
  • SCIM 2.0
  • JSON Web Tokens (JWT)
  • JSON Web Keys (JWK/JWKS)
  • Public Key Infrastructure (PKI)
  • X.509 Certificates
  • Public Key Cryptography
  • Digital Signatures
  • Cryptographic Key Management
  • Federation Protocols

D05 — Identity Platform & CIAM

Scope: Design, development, integration, and operation of Identity Providers and Customer Identity Platforms.

Key Knowledge Areas:

  • Identity Provider (IdP) Architecture
  • Single Sign-On (SSO)
  • Identity Federation
  • Identity Brokering
  • Customer Identity & Access Management (CIAM)
  • Customer Registration and Onboarding
  • Identity Proofing
  • Social Login
  • Customer MFA
  • Account Linking
  • Account Recovery
  • Token Management
  • Session Management
  • Identity APIs
  • Authentication Orchestration
  • Identity Platform Scalability and Availability

Representative Technologies:

  • Keycloak
  • Auth0
  • Okta Customer Identity
  • Amazon Cognito
  • Microsoft Entra External ID

D06 — Workforce & Directory Identity

Scope: Enterprise employee identities, directory infrastructure, workstation authentication, and device identity.

Key Knowledge Areas:

  • Active Directory Domain Services (AD DS)
  • Microsoft Entra ID
  • LDAP Directory Services
  • Workforce Identity
  • Hybrid Identity
  • Directory Synchronization
  • Windows Workstation Logon
  • macOS Authentication
  • Domain Join / Entra Join / Hybrid Join
  • Device Identity and Registration
  • Cached Credentials and Offline Authentication
  • Group Policy
  • Microsoft Intune
  • Mobile Device Management (MDM)
  • Workforce SSO
  • Device Trust and Compliance

D07 — Identity Governance & Administration (IGA)

Scope: Identity lifecycle management, access governance, provisioning, and compliance for human and non-human identities.

Key Knowledge Areas:

  • Joiner-Mover-Leaver (JML)
  • Identity Lifecycle Management
  • Authoritative Identity Sources
  • Identity Provisioning and Deprovisioning
  • SCIM Provisioning
  • Access Requests
  • Approval Workflows
  • Access Certifications and Reviews
  • Role Management and Role Mining
  • Segregation of Duties (SoD)
  • Entitlement Management
  • Identity Reconciliation
  • Identity Ownership
  • Human and NHI Governance
  • Audit and Compliance

Representative Technologies:

  • SailPoint IdentityIQ
  • SailPoint Identity Security Cloud
  • Saviynt
  • Microsoft Entra ID Governance
  • One Identity Manager

D08 — Privileged Access Management (PAM)

Scope: Protection, governance, and monitoring of privileged identities, credentials, and sessions.

Key Knowledge Areas:

  • Privileged Accounts
  • Privileged Access Management
  • Privileged Identity Management (PIM)
  • Credential Vaulting
  • Password and Credential Rotation
  • Privileged Session Management
  • Session Recording and Monitoring
  • Just-in-Time (JIT) Access
  • Just Enough Administration (JEA)
  • Break-Glass Access
  • Privileged Account Discovery
  • Privileged Non-Human Identities
  • Secrets Management Integration
  • PAM APIs and Automation

Representative Technologies:

  • CyberArk
  • Delinea
  • BeyondTrust
  • HashiCorp Vault
  • Microsoft Entra PIM

D09 — Non-Human Identity (NHI)

Scope: Identification, authentication, authorization, lifecycle management, and governance of non-human principals across enterprise environments.

Key Knowledge Areas:

NHI Fundamentals

  • Non-Human Identity Definitions
  • Identity Subject vs Account vs Credential
  • Human vs Non-Human Identity
  • NHI Classification

NHI Subject Categories

  • Service and Integration Identities
  • Application Identities
  • Database Application Accounts
  • Workload and Microservice Identities
  • Infrastructure Identities
  • Machine and Device Identities
  • API Client Identities
  • Automation and CI/CD Identities
  • AI Agent Identities

NHI Lifecycle & Governance

  • NHI Discovery and Inventory
  • Identity Ownership
  • Provisioning and Decommissioning
  • Entitlement Management
  • Orphaned Identities
  • Shared Identities
  • NHI Governance

NHI Authentication & Credentials

  • Service Account Credentials
  • API Keys
  • Machine Certificates
  • Short-Lived Credentials
  • Secrets Management
  • Credential Rotation and Revocation
  • Credentialless and Federated Authentication Models

NHI Security

  • Excessive Privileges
  • Credential Exposure
  • Identity Misuse
  • Ownership Gaps
  • NHI Security Monitoring

D10 — Cloud & Workload Identity

Scope: Identity and access management for cloud infrastructure, cloud-native services, and software workloads.

Key Knowledge Areas:

  • AWS IAM
  • Microsoft Azure IAM
  • Google Cloud IAM
  • Cloud Service Principals
  • Azure Managed Identities
  • GCP Service Accounts
  • AWS IAM Roles
  • Kubernetes Service Accounts
  • Kubernetes RBAC
  • Workload Identity Federation
  • SPIFFE / SPIRE
  • SPIFFE Verifiable Identity Documents (SVID)
  • Mutual TLS (mTLS)
  • Service-to-Service Authentication
  • Short-Lived Workload Credentials
  • Cloud Secrets Management
  • Infrastructure Identity
  • Workload Identity Lifecycle

D11 — Identity Security & Zero Trust

Scope: Security architecture, threat detection, attack prevention, and incident response relating to identity systems.

Key Knowledge Areas:

  • Zero Trust Architecture
  • Zero Trust Network Access (ZTNA)
  • Conditional Access
  • Identity Threat Detection and Response (ITDR)
  • Identity Attack Paths
  • Credential Theft
  • Session Hijacking
  • Token Theft and Replay
  • Privilege Escalation
  • Identity-Based Lateral Movement
  • Account Takeover
  • Phishing-Resistant Authentication
  • Identity Security Monitoring
  • Human and NHI Threat Detection
  • Excessive Privilege Exposure
  • Identity Incident Response

D12 — Emerging Identity Technologies

Scope: Emerging approaches to digital identity, autonomous systems, and identity interoperability.

Key Knowledge Areas:

  • AI Agent Identity
  • Agent Authentication
  • Agent Authorization
  • Human-to-Agent Delegation
  • Agent-to-Agent Delegation
  • Agent Identity Lifecycle
  • AI Agent Access Governance
  • Autonomous Identity Systems
  • Verifiable Credentials
  • Decentralized Identifiers (DIDs)
  • Digital Identity Wallets
  • Emerging Identity Standards
  • Evolving Workload and Agent Identity Models

3. Career Learning Tracks

Track A — Identity Platform & CIAM Engineering

Target Roles:

  • Identity Platform Engineer
  • CIAM Engineer
  • Authentication Engineer
  • Identity Software Engineer
  • Identity Infrastructure Engineer

Core Domains:

  • D01 — Identity Fundamentals
  • D02 — Authentication
  • D03 — Authorization & Access Control
  • D04 — Identity Protocols & Cryptography
  • D05 — Identity Platform & CIAM
  • D09 — Non-Human Identity
  • D10 — Cloud & Workload Identity
  • D11 — Identity Security & Zero Trust

Supporting Domains:

  • D06 — Workforce & Directory Identity
  • D07 — Identity Governance & Administration
  • D08 — Privileged Access Management
  • D12 — Emerging Identity Technologies

Career Objective:

Design, build, integrate, operate, and secure modern identity and authentication platforms.

Track B — Enterprise IAM / PAM / IGA Engineering

Target Roles:

  • IAM Engineer
  • IGA Engineer
  • PAM Engineer
  • Workforce Identity Engineer
  • Identity Security Engineer
  • Enterprise Identity Engineer

Core Domains:

  • D01 — Identity Fundamentals
  • D02 — Authentication
  • D03 — Authorization & Access Control
  • D04 — Identity Protocols & Cryptography
  • D06 — Workforce & Directory Identity
  • D07 — Identity Governance & Administration
  • D08 — Privileged Access Management
  • D09 — Non-Human Identity
  • D11 — Identity Security & Zero Trust

Supporting Domains:

  • D05 — Identity Platform & CIAM
  • D10 — Cloud & Workload Identity
  • D12 — Emerging Identity Technologies

Career Objective:

Implement, integrate, automate, govern, and secure enterprise identity infrastructure and access management systems.

4. Content Architecture

The platform contains four primary content collections.

4.1 Questions — Question-Driven Learning

Explore real engineering questions to discover relevant knowledge.

Examples:

  • How do employees authenticate to corporate workstations?
  • How does a DevOps engineer access production infrastructure?
  • How does a Spring Boot application authenticate to PostgreSQL?
  • How does SailPoint provision access to Active Directory?
  • How do AI Agents authenticate to enterprise services?

4.2 Knowledge Base — Technical Knowledge

Organize reusable technical knowledge across the 12 domains.

Content Types:

  • Technical Concepts
  • Protocols and Standards
  • Authentication and Authorization Mechanisms
  • Architecture Patterns
  • Implementation Guides
  • Troubleshooting
  • Hands-on Labs

4.3 Identity Attacks — Real-World Security Case Studies

Analyze documented identity-related security incidents.

Research Areas:

  • Incident Background
  • Confirmed Attack Timeline
  • Identity Attack Path
  • Compromised Identities and Credentials
  • Trust Boundary Analysis
  • Security Control Failures
  • Defensive Architecture
  • Lessons Learned

Clearly distinguish confirmed facts, evidence-supported inferences, and hypothetical attack scenarios.

4.4 Enterprise Architecture — Real-World Identity Solutions

Research how major companies design and operate IAM, PAM, IGA, and CIAM systems.

Research Areas:

  • Enterprise Identity Architecture
  • Identity Technology Stack
  • Authentication and Authorization Infrastructure
  • Workforce IAM Solutions
  • Identity Governance Platforms
  • Privileged Access Solutions
  • Customer Identity Platforms
  • Engineering Challenges
  • Architecture Decisions and Trade-offs

Use public engineering articles, documentation, technical presentations, job descriptions, and other verifiable sources. Distinguish confirmed implementations from reasonable inferences.

5. Learning & Knowledge Development Strategy

Question-Driven Learning Process

  1. Ask — Identify a real-world Identity Engineering question.
  2. Discover — Identify the concepts, protocols, technologies, and engineering problems involved.
  3. Classify — Map discovered knowledge to the relevant domains.
  4. Research — Study technical standards, documentation, implementation patterns, and evidence.
  5. Document — Add reusable knowledge to the Knowledge Base.
  6. Connect — Link relevant questions, technologies, implementations, enterprise research, and security incidents.
  7. Expand — Identify new questions and continue learning.

Long-Term Evolution

Question-Driven Learning → Knowledge Base → Knowledge Graph → Structured Curriculum → Living Identity Engineering Textbook

6. Framework Governance Principles

  1. One Unified Knowledge Base: Maintain a single authoritative knowledge repository.
  2. Domain-Based Classification: Organize knowledge primarily by engineering responsibility.
  3. Question-First Learning: Allow real-world questions to determine what to study next.
  4. Cross-Domain Knowledge: A question may involve multiple domains.
  5. Knowledge Reusability: Avoid duplicating shared technical explanations.
  6. Vendor-Neutral Foundations: Explain core principles independently of vendor implementations.
  7. Vendor-Specific Engineering: Include practical implementations using commercial and open-source technologies.
  8. Evidence-Based Research: Distinguish confirmed information, inferences, and hypothetical scenarios.
  9. Progressive Expansion: Introduce additional topics and subdomains as knowledge develops.
  10. Career Alignment: Support both professional learning tracks and practical interview preparation.
  11. Engineering Portfolio: Showcase technical understanding, code, architecture, security analysis, and research.
  12. Future Textbook Compatibility: Preserve a structure that can evolve into a complete curriculum.

Version: 0.4
Status: Working Domain Framework
Knowledge Domains: 12
Career Learning Tracks: 2
Primary Content Collections: 4
Learning Approach: Question-Driven
Long-Term Goal: Living Identity Engineering Textbook & Professional Engineering Portfolio

Identity Engineering

A question-driven living textbook for the systems that decide who can do what.

Learning & knowledge development

Ask → Discover → Classify → Research → Document → Connect → Expand.

On this page

Identity Engineering Domain Framework v0.41. PurposeCore Principles2. Knowledge DomainsD01 — Identity FundamentalsD02 — AuthenticationD03 — Authorization & Access ControlD04 — Identity Protocols & CryptographyD05 — Identity Platform & CIAMD06 — Workforce & Directory IdentityD07 — Identity Governance & Administration (IGA)D08 — Privileged Access Management (PAM)D09 — Non-Human Identity (NHI)D10 — Cloud & Workload IdentityD11 — Identity Security & Zero TrustD12 — Emerging Identity Technologies3. Career Learning TracksTrack A — Identity Platform & CIAM EngineeringTrack B — Enterprise IAM / PAM / IGA Engineering4. Content Architecture4.1 Questions — Question-Driven Learning4.2 Knowledge Base — Technical Knowledge4.3 Identity Attacks — Real-World Security Case Studies4.4 Enterprise Architecture — Real-World Identity Solutions5. Learning & Knowledge Development StrategyQuestion-Driven Learning ProcessLong-Term Evolution6. Framework Governance Principles