Skip to content

Security workshop · 7 chapters · 94 minutes

Enterprise auth, hands on.

Run a single sign-on flow on your laptop and read every step. Verify ID tokens, read a SAML assertion, map roles to permissions, then find a real cross-tenant leak and make the database stop it.

  • SSO
  • OAuth 2.0
  • OIDC
  • PKCE
  • SAML
  • RBAC
  • Multi-tenant
  • RLS
Start the workshopView the code
python -m sso probesigned in as carol, globex
1 200 LEAK acme Wayne Industries
2 200 LEAK acme Stark Logistics
3 200 LEAK acme Oscorp
4 200 ok globex Initech
5 200 ok globex Hooli
3 invoices from another tenant. Chapter 06 fixes it in one line.

What you run and read

Identity providerlab/sso/idp.pyOIDC code flow with PKCE, in memory.
Tokenslab/sso/tokens.pySign, decode and verify a JWT.
Roleslab/sso/rbac.pyRoles in, permissions out.
Tenantslab/postgres/rls.sqlIsolation in code, then in Postgres.

7 short chapters

Each one is a few minutes of reading, one thing to run or break, and an exercise. By the end you can answer an enterprise customer's security review with a straight face.

  1. 01The map10 min
  2. 02The OAuth 2.0 code flow, with PKCE15 min
  3. 03OIDC ID tokens15 min
  4. 04SAML in one page12 min
  5. 05Roles and permissions12 min
  6. 06Tenant isolation: find the leak15 min
  7. 07Row-level security, and the enterprise checklist15 min

Run it in a minute

You need uv and git. Then open http://127.0.0.1:8401 and sign in. Docker is only needed for the last chapter.

git clone https://github.com/jars-demo/enterprise-auth-demo.git
cd enterprise-auth-demo/lab
uv sync
uv run python -m sso serve