User Authentication Protocols: Kerberos, Federation and Modern Sign-In

IntermediateFree5 modules · 15 lessons · ~2 min

About this course

A complete tour of how systems actually verify who a user is: password storage done right, honest comparisons of multi-factor methods, Kerberos as a worked example of ticket-based authentication, federated identity through SAML, OAuth 2.0 and OpenID Connect, and modern passkey sign-in. You will finish able to choose the right method for a given system and recognize the failure modes, from credential stuffing to session fixation, that recur across every protocol covered.

What you'll learn

Passwords and Multi-Factor Authentication

Passwords and Password Storage Done Right
Multi-Factor Authentication Methods and Their Relative Strength
Account Recovery and the Failure Modes of Each Factor

Kerberos: Ticket-Based Authentication

Kerberos Fundamentals: Tickets, the KDC and Mutual Authentication
The Kerberos Authentication Flow Worked Through
Kerberos Failure Modes: Golden Tickets, Clock Skew and Cross-Realm Trust

Federated Identity and Token-Based Sign-In

Federated Identity Concepts: Identity Providers, Relying Parties and Trust
Security Assertion Markup Language (SAML) Single Sign-On
OAuth 2.0: Roles, Grants and What Authorisation Actually Means
OpenID Connect: Adding Authentication on Top of OAuth 2.0

01Passwords and Multi-Factor Authentication3 lessons

Passwords and Password Storage Done Right
Multi-Factor Authentication Methods and Their Relative Strength
Account Recovery and the Failure Modes of Each Factor

02Kerberos: Ticket-Based Authentication3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Passkeys and Public-Key-Based Sign-In

Passkeys and WebAuthn: Public Key Based Sign-In
Choosing an Authentication Method: A Decision Framework

Sessions and Failure Modes

Session Management: Tokens, Cookies and Lifetimes
Common Authentication Failure Modes Across Protocols
Authentication in the Software Supply Chain Context

Kerberos Fundamentals: Tickets, the KDC and Mutual Authentication

The Kerberos Authentication Flow Worked Through

Kerberos Failure Modes: Golden Tickets, Clock Skew and Cross-Realm Trust

03Federated Identity and Token-Based Sign-In4 lessons

Federated Identity Concepts: Identity Providers, Relying Parties and Trust
Security Assertion Markup Language (SAML) Single Sign-On
OAuth 2.0: Roles, Grants and What Authorisation Actually Means
OpenID Connect: Adding Authentication on Top of OAuth 2.0

04Passkeys and Public-Key-Based Sign-In2 lessons

Passkeys and WebAuthn: Public Key Based Sign-In
Choosing an Authentication Method: A Decision Framework

05Sessions and Failure Modes3 lessons

Session Management: Tokens, Cookies and Lifetimes
Common Authentication Failure Modes Across Protocols
Authentication in the Software Supply Chain Context2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.