RAG Explainer EP06 | IAM, OAuth2, OIDC, Tokens & Keycloak Explained

Welcome to Secure AI Learning Lab.

In this video, I explain one of the most important foundations for any serious enterprise software or AI application: Identity and Access Management, also known as IAM.

Many developers and architects avoid IAM because terms like authentication, authorization, OAuth2, OpenID Connect, access tokens, ID tokens, refresh tokens, scopes, claims, and identity providers can sound intimidating. But the core concepts are not difficult when we connect them to real life.

In this session, I explain IAM using practical examples such as food delivery access to your home, airport identity verification, visitor badges, banking applications, and social login flows.

This video covers:

- What Identity and Access Management means
- Authentication vs. Authorization
- Real-life examples of access control
- Why serious AI and enterprise applications need IAM from the beginning
- What authentication factors mean
- Something you know: password, PIN, security question
- Something you have: OTP, authenticator app, YubiKey
- Something you are: fingerprint, face scan, biometrics
- What OAuth2 means
- Why OAuth2 is an authorization protocol
- OAuth2 roles: resource owner, client, resource server, authorization server
- Access tokens explained using a visitor badge analogy
- Why applications should not store user passwords from other systems
- What OpenID Connect adds on top of OAuth2
- What an ID token is
- What the /userinfo endpoint is used for
- What a refresh token is
- What JWT claims such as issuer, subject, audience, scope, expiration, and issued-at mean
- How commercial and open-source IAM providers fit into enterprise architecture
- Microsoft Entra ID, Okta, Ping Identity, and Keycloak
- Why Keycloak is powerful for secure enterprise proof-of-concepts and learning labs

The key message is simple: IAM is not optional. Any serious enterprise AI, RAG, Agentic AI, or secure application architecture must understand who the user is, what the user is allowed to do, and how that activity is logged, monitored, and audited.

This video is useful for architects, developers, cybersecurity learners, AI engineers, technology leaders, and anyone building secure enterprise applications.

Subscribe to Secure AI Learning Lab for practical Enterprise AI, Secure AI, Agentic AI, RAG, Python, Flask, LangChain, Keycloak, OAuth2/OIDC, and secure-by-design architecture walkthroughs.

Chapters:
00:00 Introduction
00:06 Why IAM matters for serious projects
00:34 IAM is easier than it sounds
00:57 Authentication and authorization
01:22 Real-life IAM: food delivery and home access
02:03 Airport identity verification analogy
02:44 Identity providers: Entra ID, Keycloak, Okta
03:15 Audit, compliance, logging, and monitoring
03:34 Authentication factors explained
04:13 Authorization explained
04:29 Authentication using the “authentic” analogy
05:14 OAuth2 explained
06:07 OAuth2 roles: resource owner, client, resource server
07:13 OAuth2 tokens
07:17 Access token explained
08:15 OpenID Connect and ID token
09:23 User profile and /userinfo endpoint
10:02 Refresh token explained
10:56 Access token claims explained
11:47 ID token claims explained
12:06 Refresh token behavior
12:13 IAM providers: Entra ID, Okta, Ping, Keycloak
12:45 Keycloak discussion
13:08 Closing and next session

#IAM #OAuth2 #OIDC #Keycloak #SecureAI

Видео RAG Explainer EP06 | IAM, OAuth2, OIDC, Tokens & Keycloak Explained канала Secure AI Learning Lab