Products change quickly; capabilities change slowly. This page maps the main product categories to the capability map and lists representative examples with links to their official documentation.
The lists are illustrative, alphabetical within each category, and not exhaustive. Inclusion is not an endorsement. Check current features, certifications, licensing, and support terms in each vendor’s documentation.
Identity providers and access management (workforce and customer)
Authentication, SSO, federation (OIDC, SAML), MFA, and OAuth authorization servers.
| Product | Type | Documentation |
|---|---|---|
| Amazon Cognito | Cloud service | docs.aws.amazon.com/cognito |
| Auth0 | Cloud service | auth0.com/docs |
| authentik | Open source | docs.goauthentik.io |
| Curity Identity Server | Commercial, self-hosted or cloud | curity.io/docs |
| Duende IdentityServer | .NET framework (commercial license) | docs.duendesoftware.com |
| Google Cloud Identity Platform | Cloud service | docs.cloud.google.com/identity-platform/docs |
| Keycloak | Open source (CNCF) | keycloak.org/documentation |
| Microsoft Entra ID | Cloud service | learn.microsoft.com/entra/identity |
| Okta | Cloud service | developer.okta.com |
| Ory (Hydra, Kratos) | Open source and cloud | ory.com/docs |
| Ping Identity | Commercial, cloud and self-hosted | docs.pingidentity.com |
| ZITADEL | Open source and cloud | zitadel.com/docs |
The OpenID Foundation publishes a list of certified OpenID Connect and FAPI implementations, a useful neutral starting point.
Identity governance and administration (IGA)
Lifecycle, access requests, certifications, separation of duties. See IGA.
| Product | Documentation |
|---|---|
| Evolveum midPoint (open source) | docs.evolveum.com/midpoint |
| Omada | documentation.omadaidentity.com |
| SailPoint | documentation.sailpoint.com |
| Saviynt | saviynt.com (product documentation requires a customer login) |
Privileged access and secrets
Vaulting, session brokering, just-in-time elevation, and secret management. See PAM.
| Product | Focus | Documentation |
|---|---|---|
| BeyondTrust | PAM | docs.beyondtrust.com |
| CyberArk (now Palo Alto Networks Idira) | PAM, secrets | paloaltonetworks.com/idira |
| Delinea | PAM | docs.delinea.com |
| HashiCorp Boundary | Session brokering | developer.hashicorp.com/boundary/docs |
| HashiCorp Vault / OpenBao | Secrets, dynamic credentials | developer.hashicorp.com/vault/docs, openbao.org |
| Teleport | Infrastructure access | goteleport.com/docs |
Authorization engines
Externalized, fine-grained authorization. See access control models and policy engines.
| Project | Model | Documentation |
|---|---|---|
| Amazon Verified Permissions | Cedar policies (managed) | docs.aws.amazon.com/verifiedpermissions |
| Cedar | Policy language and engine | docs.cedarpolicy.com |
| Cerbos | Policy-based | docs.cerbos.dev |
| Open Policy Agent | Policy-based (Rego) | openpolicyagent.org/docs |
| OpenFGA | Relationship-based | openfga.dev/docs |
| SpiceDB | Relationship-based | authzed.com/docs |
API gateways
Token validation, rate limiting, and policy enforcement at the edge. See API gateway policies.
| Product | Documentation |
|---|---|
| Amazon API Gateway | docs.aws.amazon.com/apigateway |
| Apigee | docs.cloud.google.com/apigee/docs |
| Azure API Management | learn.microsoft.com/azure/api-management |
| Envoy (open source) | envoyproxy.io/docs |
| Kong Gateway | developer.konghq.com |
Workload identity
| Project | Documentation |
|---|---|
| SPIFFE / SPIRE (open source, CNCF) | spiffe.io/docs |
| Cloud workload identity federation | See each cloud provider’s IAM documentation. |
Client libraries
Use maintained, preferably certified, libraries rather than writing protocol code.
| Library | Platform | Documentation |
|---|---|---|
| AppAuth | iOS, Android, JS | appauth.io |
| Authlib | Python | docs.authlib.org |
| jose, openid-client | Node.js and browsers | github.com/panva/jose, github.com/panva/openid-client |
| MSAL | Multiple platforms | learn.microsoft.com/entra/identity-platform/msal-overview |
| Nimbus JOSE + JWT, Nimbus OAuth | Java | connect2id.com/products/nimbus-jose-jwt |
| Spring Security OAuth 2.0 | Java | docs.spring.io/spring-security |
How to choose
| Criterion | Questions |
|---|---|
| Standards | Which OIDC, SAML, SCIM, and OAuth extensions (PAR, DPoP, RAR) are supported? Is it certified? |
| Populations | Workforce, customers, partners, workloads? At what scale? |
| Deployment | Cloud, self-hosted, hybrid? Data residency requirements? |
| Extensibility | Custom flows, hooks, claims, connectors? |
| Operations | SLA, disaster recovery, key rotation, upgrades, observability? |
| Security | Admin protection, audit logs, phishing-resistant MFA, tenant isolation? |
| Exit | Can users, credentials, and configuration be exported? How hard is migration? |
| Cost | Pricing per user, per active user, per connection, or per API call? |
Run a proof of concept with your own hardest use cases, such as a rehire, a partner federation, or a step-up flow, before deciding.