sota-identity-accesslisted
State-of-the-art identity and access management engineering (2026) for BUILDING/configuring identity infrastructure AND AUDITING it — federation, IdPs, authorization models, the joiner-mover-leaver lifecycle, privileged/break-glass access, workload identity, MFA/passkeys, and assurance levels; audits cover orphaned accounts, over-privileged roles, weak MFA, long-lived tokens, and SAML misconfig. Owns identity INFRASTRUCTURE and access-management DESIGN, not app-level login/session/JWT mechanics (sota-code-security owns those). Trigger keywords: IAM, IdP, OIDC, OAuth 2.1, PKCE, DPoP, PAR, RAR, JAR, FAPI, SAML, SCIM, provisioning, deprovisioning, RBAC, ABAC, ReBAC, Zanzibar, OpenFGA, SpiceDB, OPA, Cedar, Kanidm, Keycloak, Authentik, Zitadel, Entra, Okta, SSO, single logout, MFA, passkey, FIDO2, WebAuthn, step-up, conditional access, CAEP, PAM, break-glass, just-in-time, SPIFFE, access review, NIST 800-63, IAL, AAL, FAL, Active Directory, Kerberos, Kerberoasting, ADCS, RBCD, gMSA, dMSA, LAPS, krbtgt.
martinholovsky/SOTA-skills · ★ 8 · Code & Development · score 75
Install: claude install-skill martinholovsky/SOTA-skills
# SOTA Identity & Access
## Purpose
Own the identity **infrastructure** and access-management **design** of a system:
the federation protocols themselves, the IdP that issues and validates tokens, the
authorization model that decides who may do what, the lifecycle that creates and
destroys access, privileged access, and machine identity. Two modes. In **BUILD**
mode you stand up or configure this infrastructure correctly by default. In **AUDIT**
mode you assess an existing identity estate against the same rules and report
severity-rated findings. The rules files are the single source of truth for both.
Boundary discipline — this skill does **not** re-teach what siblings own:
- **App-level authn ceremony** (password storage/argon2id, session cookie flags,
WebAuthn ceremony, JWT *signature* validation mechanics at one RP): that is
**sota-code-security** rules/02. This skill owns the protocol and the IdP side.
- **App-level object/function authz** (IDOR/BOLA in one service's handlers): that is
**sota-code-security** rules/03. This skill owns the authorization *model* and the
*policy engine* that the app calls.
- **Secret storage, OIDC-federation mechanics for workloads, JWT `kid` rotation as a
credential operation**: **sota-secrets-management** rules/01 and rules/05.
Concurrent siblings to invoke alongside: **sota-network-security** (mTLS, ZTNA,
identity-aware proxy), **sota-kubernetes** (K8s RBAC, OIDC to the API server, SA
tokens), **sota-detection-engineering**