🧪 Practicals
Do the things the Academy simulates — for real. Completion is derived from the actual server events you generate, never self-reported.
Heads up: Practical 7 (Be the client) and the OIDC assignment need a registration invite — email akhil@integrauth.com.
New to the Lab? There's also a guided attack → detect → respond scenario that chains several of these practicals into one incident.
Passwordless foundations
The core credential lifecycle: prove an email, go passwordless with a passkey, understand your session, add a second factor, and step it up when it matters.
Prove an email is yours
Sign up with a one-time code — no link, no password.
Go passwordless
Register a passkey, then sign back in with it.
Anatomy of your session
Inspect a real session, then revoke one.
Add a second factor
Enroll a TOTP authenticator (RFC 6238).
Step up before a sensitive action
Enrol TOTP, then re-prove it to rotate a client secret — session step-up (AAL).
Lose a device, keep your account
Enrol a spare passkey, then retire one — the lifecycle a lost device forces on you.
Read a passkey like an engineer
AAGUID, synced-vs-device-bound, and autofill — the metadata behind that one-tap sign-in.
Prove a passkey’s make and model
Register a passkey with attestation, then read what it actually proved.
OAuth / OIDC
Run a real authorization-code + PKCE flow end to end, then explore the token grants beyond it — devices without a keyboard, machine-to-machine, delegation and sender-constraining.
Read your own token
Issue a real ES256 JWT, then tamper with it and watch verification fail.
Be the client: OIDC end-to-end
Register your own app and sign a user in through the Lab with a real code + PKCE flow.
Log in a device (no keyboard)
Sign in a TV or CLI with the RFC 8628 device flow — a short code, approved on your phone.
A token with no user (client credentials)
Mint a service token for machine-to-machine calls — no human, no id_token, no refresh.
See it from the app's side (the Demo RP)
Be the relying party: run a full code + PKCE login through the Lab and validate the ID token — no invite needed.
Delegate to an agent (token exchange)
Swap a user’s access token for an agent token that acts on their behalf — visible in the token.
Sender-constrain a token (DPoP)
Bind a token to a key you hold so a stolen copy is useless — RFC 9449 proof-of-possession.
Enterprise & lifecycle
The plumbing enterprise IT depends on: HR-driven provisioning, enterprise SSO, JIT account linking, multi-tenant orgs, right-to-be-forgotten, and continuous security signals.
Provision a user like an HR system
Push a SCIM user into a directory — the automated Joiner every onboarding pipeline relies on.
Watch a security event become a signed signal
Revoke a session and watch it turn into a signed SET, pushed to a receiver that checks it against the JWKS.
Sign in with a federated identity — link, then federate
Link a simulated upstream IdP identity to your account, sign in with it, then watch the Lab refuse the same assertion in anyone else’s hands — because a matching email is never proof.
Exercise your right to be forgotten
A read-only walk through what erasure would take — and what a tamper-evident log keeps anyway.
Enterprise SSO with SAML — sign, POST, validate
Run a real SP-initiated SAML 2.0 login: a signed assertion, POSTed, then fully validated.
Run a tenant: orgs, roles & invites
Create an organization, invite a teammate by email, and see role-based guardrails enforced server-side.
Threat detection & response
Watch attacks turn into alerts, and alerts turn into action: single-shot and volume-based detection, device recognition, adaptive risk, emergency access, and closed-loop enforcement.
Trip a detector, raise an alert
Reuse a rotated refresh token and watch ITDR fire a real security alert (token theft).
The panic button
One click to sign out every other device and cut every connected app’s access.
Volume is a signal too
No single request is malicious — but hammer a sensitive endpoint and ITDR notices anyway.
Recognize your own devices
See how the Lab tells a familiar sign-in from a brand-new one — and why that matters most right after a recovery.
Break the glass — loudly
Self-elevate to a sensitive capability under emergency controls: justification, step-up, a time box, and a SOC alert the whole team sees.
Close the loop — from signal to enforcement
A CAEP signal isn’t just logged — the receiver re-decides your access, live, mid-session.
Turn signals into a decision
Watch device recognition, alert history, velocity and a simulated impossible-travel flag combine into one explainable risk score — and one decision.
AI / agent security
Model access as relationships, then watch that same graph gate an AI agent: its own identity, human-approved sensitive actions, authorized tool calls and retrieval, delegation chains, and a prompt-injection attack defeated by code instead of a plea.
Model access as relationships (ReBAC)
Write relationship tuples, then prove access with a Zanzibar-style Check that resolves the graph.
Register an AI agent, then kill it
Give an AI agent its own identity — scoped, secreted, and instantly revocable.
Approve an agent's action (CIBA + RAR)
An AI agent asks for approval to do one exact thing — you approve it, and it gets a token for nothing more.
Retrieve like an agent — but only what you’re allowed
Run a RAG query through your own AI agent, and watch a real FGA Check gate every document.
Delegate down a chain of agents
Agent A hands agent B a subset of its scopes; B hands a subset to C — then kill any one and watch the whole chain die.
Authorize a tool call, not just a prompt
Invoke a fixed MCP tool catalog — every call is gated on scope, agent liveness, and, when delegated, the whole chain.
Defeat a prompt injection — with code, not a plea
A document tries to hijack the model. Watch a real authorization check make its instructions inert.
Attack range
Play the attacker, then watch the defense hold: push-bombed MFA, a fake consent screen, a phished device code, and a hijacked session cookie — four attacks the Lab lets you actually run. (Two more attack labs — account-takeover and prompt-injection defense — already live in the Threat detection and AI/agent security tracks above; the full six-lab catalog and guided multi-lab scenarios chaining all of them live at /attack-range.)
Defeat a push-bombing attack — with a number, not a plea
Flood yourself with approval prompts, then watch a blind tap fail while the flood gets throttled.
Spot a consent-phishing request — before you click Allow
Compose a fake "Microsoft Login" asking for everything, watch the risk banner explain why, then revoke it.
Phish a device code — then watch transparency catch it
Start a device sign-in as the attacker, then see the victim screen expose WHERE it actually started.
Steal a cookie — then watch the theft get caught
Prove HttpOnly hides the real cookie from JavaScript, then replay a sandbox token from an "attacker" browser and watch it get flagged.
Protocols & standards
Lower-level building blocks other tracks lean on: a fixed-window rate limit, signed API-key webhooks, certificate-bound tokens, keyless workload identity, and selective-disclosure verifiable credentials.
Hit a real rate limit
Hammer a demo endpoint and watch the fixed-window limiter fire a 429.
Run the gateway: keys & signed webhooks
Mint an API key, call the gateway with it, and receive an HMAC-signed webhook — the Stripe pattern.
Bind a token to a certificate (mTLS)
Issue a token bound to a client cert, then present a different one and watch access refuse it.
Give a workload an identity — no stored secret
Exchange a simulated platform credential for a short-lived SPIFFE JWT-SVID — RFC 8693 token exchange, keyless.
Prove one claim, hide the rest
Issue a selective-disclosure credential, then present only membership_level — verify it without ever seeing your date of birth.
More
Not yet part of a curated track.
Harden the front channel (PAR + JARM)
Push your authorization request over a back channel, then get a signed, tamper-evident response back.
Single Logout
End one browser session and watch every relying party get told.
Provision a group, not just a user
Push a SCIM group with members, then PATCH its membership like a real HR reorg.
Resolve a trust chain to a pinned anchor
Register a subordinate entity, then watch the resolver verify a chain up to a pinned trust anchor, hop by hop.
Stand up a Shared Signals receiver — and drain its queue
Create a poll stream, subscribe yourself as a subject, then poll: verifiable SETs, drained and acked.
Run the real credential issuance protocol
Create an offer, exchange the pre-authorized code, prove your key — and watch a cnf-bound credential land in your wallet.
Cap an agent beyond its scopes
Scopes say WHICH tools an agent can call. A declarative policy says HOW — a capped amount, an allowed recipient domain — even when the scope alone would allow it.
Run an access review — certify or revoke
Snapshot your own entitlements into a recertification campaign, then decide each one — a revoke really removes the grant.
Find the drift — directory vs. access
Diff your SCIM directory against real org access, live — and fix a stale grant with one click.
Sign in with a magic link
Email yourself a one-click sign-in link — single-use, 15 minutes, and never auto-clicked.
Verify an identity — without hoarding the document
Submit simulated ID evidence and watch the Lab keep only the verdict, never the document.
Externalize an authorization decision (PDP/PEP)
Author declarative policy rules, then watch deny-overrides win even for the resource’s own owner.
Tour the OWASP API Top 10
Walk all ten OWASP API Security risks and map each one to a real Lab defense you already built.
Climb the assurance ladder
Make identity verification MATTER — unlock a real gated action only at the top rung.
Your policy, actually enforced
Wire the policy PDP into a REAL protected resource — and watch payroll stay denied until IDV raises your clearance.