I know this isn’t what you’re asking for but I think this is still a good starting point. Like you correctly surmised, identity and authentication management is not an easy subject and does require extensive experience and theory.