IAM standards solve different problems. Before selecting one, describe the interaction: who is communicating, which trust relationship exists, and what result the recipient needs.
The quick map
| Need | Relevant standard or family | What to read here |
|---|---|---|
| Delegate access to an API | OAuth 2.0 | OAuth, grant types, endpoints |
| Sign in to an application using an identity provider | OpenID Connect | OpenID Connect, in depth |
| Discover authorization servers and protected APIs | RFC 8414, OIDC Discovery, RFC 9728 | Discovery and metadata |
| Accept tokens in an API and request step-up | RFC 6750, RFC 9470 | Resource servers |
| Bind tokens to a client key | DPoP, RFC 9449 | DPoP |
| Protect or enrich the authorization request | PAR, JAR, RAR | PAR and JAR, RAR |
| Use OAuth from browsers and mobile apps | Browser-based apps draft, RFC 8252 | BFF, native apps |
| Manage browser sessions | HTTP cookies, RFC 6265 | Cookies and sessions |
| Exchange identity assertions, often for enterprise SSO | SAML 2.0 | SAML |
| Create and manage users and groups across systems | SCIM 2.0 | SCIM |
| Authenticate with public-key credentials on the web | WebAuthn / FIDO | Modern authentication |
| Represent and validate a set of claims | JWT, JWS, JWK | JWT and token validation, token claims |
| Sign in devices, exchange tokens, or bind tokens to a client | OAuth extensions | Advanced OAuth |
| Access a directory or authenticate inside a Windows domain | LDAP, Kerberos | LDAP and Kerberos |
| Notify other systems of revocations and compromise | Shared Signals, CAEP, RISC | Shared Signals |
| Ask a policy engine for an authorization decision | AuthZEN, XACML | Policy engines |
| Give workloads an identity without stored secrets | SPIFFE, workload federation | Non-human identities |
A format is not a complete protocol
A JWT is a token format. It does not tell you, by itself, which issuer is trusted, which keys are accepted, which recipient it is intended for, or whether it is the right kind of token for a request. JWT and token validation lists the checks a recipient applies.
Likewise, “uses JSON” says little about the trust model. A secure integration needs the surrounding protocol, validation rules, and operational controls.
Avoid one-protocol thinking
A business application can use OIDC for sign-in, SCIM for account management, and an application-specific API for permission assignment. Those choices can coexist.
An enterprise portfolio may support both SAML and OIDC because applications have different capabilities. Evaluate the actual integration and supported profiles rather than assuming one label describes every behavior.
Read standards in layers
Start with the core specification, then identify security guidance, applicable profiles, errata, and your implementation’s documentation. A published standard may contain older options that current security guidance advises against.
The articles in this section explain concepts. They are not complete implementation or conformance checklists.