IAM Platforms

Key Strengths:
  └─ Universal Directory: Single directory for users, groups, and devices
  └─ Lifecycle Management: Automated provisioning/deprovisioning via SCIM
  └─ 7,000+ pre-built integrations: Broadest app catalog
  └─ Workflows: No-code automation for identity processes
  └─ Adaptive MFA: Risk-based authentication policies

Common Use Cases:
  └─ SSO for SaaS applications (Salesforce, Slack, GitHub, AWS)
  └─ MFA enforcement for all applications
  └─ Automated user lifecycle from HR system (Workday, BambooHR)
  └─ API access management with OAuth 2.0 / OIDC
  └─ B2B federation (Org2Org)

Common Misconfigurations:
  └─ Weak sign-on policy: Not requiring MFA for all apps
  └─ Over-permissive API scopes: Granting more than needed
  └─ No session timeout: Users stay logged in indefinitely
  └─ Super admin over-provisioning: Too many users with full admin

Key Strengths:
  └─ Deep integration: Native with Office 365, Azure, Windows, Defender
  └─ Conditional Access: Granular access policies (location, device, risk)
  └─ PIM (Privileged Identity Management): JIT for privileged roles
  └─ Identity Protection: Risk-based detection of compromised accounts
  └─ Access Reviews: Built-in certification campaigns

Common Use Cases:
  └─ SSO for Microsoft 365 (Exchange, SharePoint, Teams)
  └─ MFA for all cloud applications
  └─ Conditional Access policies (managed device + MFA = full access)
  └─ PIM for Azure admin roles
  └─ B2B collaboration (guest users)

Common Misconfigurations:
  └─ Conditional Access not configured: Default = allow all
  └─ Legacy auth enabled: POP3, IMAP, SMTP bypass MFA
  └─ Admin roles over-assigned: Exchange Admin for all IT staff
  └─ Self-service group management enabled: Users can add themselves to admin groups

Choose Okta when:
  └─ Heterogeneous environment: Mix of SaaS, on-prem, and custom apps
  └─ Microsoft is not your primary stack (Google Workspace, Salesforce-centric)
  └─ Need advanced lifecycle workflows (ITSM integration, custom logic)
  └─ Require the broadest pre-built integration catalog

Choose Azure AD when:
  └─ Microsoft-centric organisation (M365, Azure, Windows)
  └─ Need deep Windows/Office/Exchange integration
  └─ Conditional Access is a priority (device compliance, location, risk)
  └─ Budget is a factor (included with M365 E3/E5)

Use BOTH when:
  └─ Azure AD for Microsoft resources, Okta for everything else
  └─ Long migration phase (moving from one to the other)
  └─ Mergers and acquisitions (different companies on different platforms)

Key Strengths:
  └─ Free and open-source (Apache 2.0 license)
  └─ Full control: Self-hosted, customisable
  └─ Standards-compliant: SAML 2.0, OAuth 2.0, OIDC 1.0
  └─ Social login: Built-in Google, Facebook, GitHub, Twitter providers
  └─ User federation: Connect to LDAP/Active Directory

Considerations:
  └─ Self-hosted: You manage infrastructure, upgrades, and security patching
  └─ Limited lifecycle management: No SCIM provisioning outbound
  └─ Limited MFA: TOTP only (extensible via SPI)
  └─ Community support: No vendor SLA

Deployment:
```bash
# Keycloak Docker deployment
docker run -d \
  --name keycloak \
  -p 8080:8080 \
  -e KEYCLOAK_ADMIN=admin \
  -e KEYCLOAK_ADMIN_PASSWORD=admin \
  -e KC_DB=postgres \
  -e KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak \
  -e KC_DB_USERNAME=keycloak \
  -e KC_DB_PASSWORD=password \
  quay.io/keycloak/keycloak:22.0 start-dev

# Create realm
kcadm.sh create realms -s realm=mycompany -s enabled=true

# Create client
kcadm.sh create clients -r mycompany \
  -s clientId=my-app \
  -s publicClient=true \
  -s redirectUris='["https://my-app.example.com/*"]'

# Create user
kcadm.sh create users -r mycompany \
  -s username=john \
  -s email=john@example.com \
  -s enabled=true

General IAM Platform Hardening:
  └─ Admin accounts:
    └─ Separate admin accounts from daily use accounts (no shared admin/personal)
    └─ Require phishing-resistant MFA (FIDO2/WebAuthn) for all admin roles
    └─ JIT activation for admin roles (PIM or equivalent)
    └─ Monitor and alert on admin activity

  └─ Application integration:
    └─ Use SAML/OIDC for SSO (avoid proxy-based integrations where possible)
    └─ Validate SAML assertions: signature, audience, recipient, timestamps
    └─ Use PKCE for OAuth public clients
    └─ Rotate client secrets regularly

  └─ User lifecycle:
    └─ Automate deprovisioning (HR trigger → account disabled within 4 hours)
    └─ Review guest/B2B users quarterly
    └─ Inactive user detection: disable after 90 days without login
    └─ Orphan account detection: accounts for departed users

  └─ Security monitoring:
    └─ Failed login attempts: alert on > 10 in 5 minutes
    └─ Impossible travel: login from geographically distant locations in short time
    └─ Suspicious admin activity: unusual time, location, or device
    └─ Token theft indicators: token used from different IP than issued