Identity and Access Management: Identification and AAA

Lesson plan

Level

Beginner

Time

About 65 minutes; the steps below add up to 64

Learners take apart a hotel check-in, a sequence everyone knows, and find the four separate steps themselves before the names arrive; a name given at the desk shows straight away that a claim is not proof. Predictions then precede each point that trips beginners up: whether the order could change, whether an email address proves anything, whether two answers are two kinds of proof, whether a refused page means a failed sign-in, and which step AAA leaves out. The habit to build: when access goes wrong, ask which of the four steps failed before changing anything.

Objectives

• Put identification, authentication, authorisation and accounting in order, and say what each one asks
• Explain why a username is a claim and not proof
• Count authentication factors by kind
• Explain why an authenticated user can still be refused
• Say what AAA stands for, why identification is not one of the As, and how IAM is wider

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Least Privilege and Non-repudiation lessons first.
• Write four blank boxes in a row on the board; label them only after the hotel lists are in.
• The lesson takes about 64 minutes. To teach it in two parts, stop after “Authentication factors”; the second part opens with “Authenticated is not authorised”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Put identification, authentication, authorisation and accounting in order, and say what each one asks
   • Explain why a username is a claim and not proof
   • Count authentication factors by kind
   • Explain why an authenticated user can still be refused
   • Say what AAA stands for, why identification is not one of the As, and how IAM is wider

   Purpose: Learners take apart a hotel check-in, a sequence everyone knows, and find the four separate steps themselves before the names arrive; a name given at the desk shows straight away that a claim is not proof. Predictions then precede each point that trips beginners up: whether the order could change, whether an email address proves anything, whether two answers are two kinds of proof, whether a refused page means a failed sign-in, and which step AAA leaves out. The habit to build: when access goes wrong, ask which of the four steps failed before changing anything.

2. 1. Checking in to a hotel Think 6 min

   Purpose: Find the four steps from a familiar sequence, and see that a claim is not proof.

   Ask

   • Everything that happens from the desk to your room door, and what the hotel records?
   • Should the receptionist hand over the card on a name alone?

   Responses to expect

   • Lists often merge “give my name” and “show my passport”. Ask which of the two the receptionist could check.
   • Recording is often forgotten; ask what the door system knows afterwards.
   • On screen in turns: the opening question, its answer; then the question on the guest who gives only a name, and its answer.

   Discussion pause: Collect lists and sort them into the four unlabelled boxes before revealing anything.

   In the lesson window

   • Think it through: You arrive at a hotel where you have booked a room. List everything that happens between walking up to the desk and opening your room door, including anything the hotel keeps a record of.
   • Think it through: Someone at the desk says: “I’m Mrs Khan, I’ve booked room 12.” Should the receptionist hand over the key card?

3. 2. The idea Explain 6 min

   Purpose: Name the four steps, with the question each asks, over the learners' boxes.

   Ask

   • The gym opens, the staff office does not. Which step decided?

   Responses to expect

   • Authentication is a common wrong answer; ask when the proof was checked.
   • On screen in turns: the opening; then the four steps and their questions, starting with identification; authentication; authorisation; accounting; the check question on the gym door, and its answer.

   Discussion pause: The table reveals one step at a time: before each row, ask the class which part of the hotel check-in it matches.

   In the lesson window

   • Check your understanding: Your key card opens the gym but not the staff office. Which of the four steps decided that?

4. 3. The access-control flow Predict 5 min

   Purpose: Show why the order is fixed, using the diagram and its note.

   Ask

   • Could permissions be decided before proof is checked?

   Responses to expect

   • Most say no once asked whose permissions would be decided.
   • Diagram: the flow reveals one step at a time, ending with the note on why the order is fixed. Ask what each step needs from the one before.
   • On screen in turns: the opening question, its answer; then the access-control flow, with identification only; authentication; authorisation; accounting, and why the order is fixed.

   If the explanation does not land: A school visitor signs in at reception (identification), shows ID (authentication), gets a badge for the hall only (authorisation), and the visitors’ book records the visit (accounting).

   In the lesson window

   • Think it through: Could the four steps happen in a different order: for example, deciding your permissions before checking your proof?

5. 4. The four steps Explain 9 min

   Purpose: Explain each step in turn, separating identity (the claim) from authentication (the proof).

   Ask

   • Does typing your email address prove the account is yours?
   • What does “accounting” mean here, if not money?

   Responses to expect

   • Some think only the owner knows their email address; ask where else it appears.
   • On screen in turns: the opening question, its answer; then what identification is, and why identities must be unique; authentication; authorisation; accounting.

   Misconceptions to challenge

   • A learner may believe: “A username proves who you are.” Respond: It is the claim; the proof comes next.

   If the explanation does not land: Return to the hotel: saying “Khan” at the desk is identification; the passport is authentication.

   To go further

   • Why does accounting depend on identification being unique?

   In the lesson window

   • Think it through: A website asks for your email address first. Does typing your email address prove that the account is yours?

6. 5. Authentication factors Predict 7 min

   Purpose: Teach the three kinds of factor and count factors by kind.

   Ask

   • Password plus first pet's name: two kinds of proof?
   • Give one example of each kind from your own life.

   Responses to expect

   • Many count them as two. Ask what an attacker would need to steal to answer both.
   • On screen in turns: the opening question, its answer; then the three kinds of factor, starting with something you know; something you have; something you are; what makes authentication multi-factor; why authentication is wider than checking a password; other kinds of evidence some syllabuses list.

   Misconceptions to challenge

   • A learner may believe: “Two passwords are two factors.” Respond: Factors are counted by kind; two things you know are one factor.
   • A learner may believe: “Authentication means comparing password hashes.” Respond: That is one method for one kind of evidence.

   In the lesson window

   • Think it through: A website asks for your password, then for the name of your first pet. Has it asked for two different kinds of proof?

7. 6. Authenticated is not authorised Predict 5 min

   Purpose: Separate a successful sign-in from permission to act.

   Ask

   • Timetable yes, staff noticeboard no: has something gone wrong?

   Responses to expect

   • Some assume a fault. Ask whether the system knows who the pupil is.
   • On screen in turns: the opening question, its answer; then read permitted, write denied; why a refused action is not a failed sign-in.

   Misconceptions to challenge

   • A learner may believe: “If you can sign in, you can do everything.” Respond: Signing in settles identity; permissions are a separate decision.

   If the explanation does not land: A library card proves who you are; it does not let you into the staff room. Being refused the staff room does not mean your library card stopped working.

   In the lesson window

   • Think it through: A pupil signs in to the school’s learning platform and can see their timetable, but gets “access denied” on the staff noticeboard. Has something gone wrong?

8. 7. Why AAA has three As Predict 7 min

   Purpose: Work out which step AAA omits, and use symptoms to identify the failing step.

   Ask

   • Which step do you think AAA leaves out, and why?
   • “Unknown user”: which step?

   Responses to expect

   • Accounting is a frequent guess because it sounds unlike security. Ask which step checks or records nothing.
   • On screen in turns: the opening question, its answer; then what AAA stands for, and why identification stands apart; symptoms to diagnose, with the steps held back; the step involved in each symptom; the help-desk call, up to the exact message; reading the symptom and finding the cause; the fix and the result.

   Misconceptions to challenge

   • A learner may believe: “The three As are identification, authentication and authorisation.” Respond: Authentication, authorisation and accounting; identification comes first.

   Discussion pause: The symptom table holds back its answers: let the class name the step for each symptom before revealing.

   To go further

   • Invent a symptom for each step that is not in the table.

   In the lesson window

   • Think it through: Three of the four steps are often grouped under the name AAA. Which one do you think is left out, and why?

9. 8. IAM is the wider discipline Explain 6 min

   Purpose: Place AAA, the moments of access, inside IAM, the management of identities over time.

   Ask

   • A leaver's account still works. Which part failed?

   Responses to expect

   • Authentication is a common answer; ask what should have happened on their last day.
   • On screen in turns: the opening; then how IAM relates to AAA; the check question on the leaver’s account, and its answer; where the lifecycle and IAM are taught next; the first question to ask when someone cannot get in.

   Misconceptions to challenge

   • A learner may believe: “If every sign-in works correctly, access is being managed well.” Respond: A leaver’s account can sign in perfectly. Managing who should still have a key is IAM, over months and years, not any single sign-in.

   In the lesson window

   • Check your understanding: Someone left the company three months ago, and their account still works. Where has the failure happened?

10. 9. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The HR folder tests reading a symptom; the server room tests counting factors.
    • On screen in turns: the opening question, its answer; then the question on the smart card and PIN, and its answer.

    In the lesson window

    • Apply it: A user signs in normally but cannot open the HR folder. A colleague resets their password, and the user still cannot open it. What should have been checked first?
    • Apply it: To enter a server room, staff tap a smart card and then type a PIN. How many authentication factors is that?

11. 10. Check your understanding Check 6 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The which-step-failed question links back to the symptom table.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

12. 11. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the four steps in order, and what each asks.

    Responses to expect

    • Who do you claim to be; prove it; what may you do; what did you do.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

13. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Claim, proof, permission, record: always in that order.
    • A name or username is never proof on its own.
    • Count factors by kind of evidence, not by number of prompts.
    • Being refused something after signing in is authorisation working, not a failed sign-in.
    • AAA happens at each access; IAM manages identities from joining to leaving.

Consolidation

• Claim, proof, permission, record: always in that order.
• A name or username is never proof on its own.
• Count factors by kind of evidence, not by number of prompts.
• Being refused something after signing in is authorisation working, not a failed sign-in.
• AAA happens at each access; IAM manages identities from joining to leaving.