Identity Lab · Practitioners · Free tool
Protocol practice
Learn the protocols by running them. Each lab gives you a role and a goal, then walks the flow one message at a time while you fill in what each request needs. Get one wrong and you'll see why it's refused.
- labs
- 6
- minutes each
- ~10
- real servers
- 0
OAuth 2.0
The authorization code flow, with PKCEYou play the app. You’re building Lumen Notes, which shows a user’s calendar events. Get permission to read their calendar and fetch today’s events, without ever seeing their password.
OpenID Connect
Sign-in, and the ID token that proves itYou play the app. Lumen Notes adds “Sign in with Harbor”. Get an ID token for Rui, check every part of it before you believe it, and find out who they really are.
SAML 2.0
Sign-in started by the service providerYou play the application. You run the company wiki at wiki.example, and Harbor’s employees sign in through Harbor’s identity provider. Sign Rui Okafor in, and refuse the assertion you shouldn’t trust.
SCIM 2.0
Joiner, mover and leaverYou play the identity platform. Harbor’s identity platform provisions accounts into the wiki. Create Rui Okafor’s account on day one, move them from Support to Engineering, and switch their access off on their last day.
Kerberos
Tickets, from sign-in to a file shareYou play the laptop. Rui signs in to the Harbor domain on a laptop, then opens the team’s file share without typing the password again. Get the tickets that make that work, and see where attackers come in.
Auth0
Customer sign-in, set up without the usual mistakesYou set up the tenant. Lumen Notes is moving its customer sign-in to Auth0. Register the app, send customers through Auth0’s sign-in page, get a token your API can check, put the customer’s plan in it, and keep them signed in safely.
Coming later
Everything here is simulated: no servers, tokens or keys. Your answers stay in your browser. If you're a member and agree to save a practice record, the labs you finish, when, and your scores are stored with your membership, until you delete them (see the privacy page). Names are fictional, on .example domains; the sample values are the published examples from the RFCs.