OAuth 2.0 – An authorization framework that allows applications to grant limited access to user resources without exposing credentials. Commonly used to give an app authorization to perform certain tasks on other apps or approve access to certain information from other apps. Giving Instagram permission to access your camera roll, giving Venmo permission to access your contacts, and giving Spotify permission to post on your behalf on Twitter are all examples of OAuth 2.0 in action. 

OpenID Connect (OIDC) – An authentication protocol built on OAuth 2.0 which adds identity verification. Commonly used for social logins like “Sign in with Google”, “Sign in with Facebook”, “Sign in with Apple”, etc. This is SSO for customers/consumers and applicable to any size business. 

SAML 2.0 (Security Assertion Markup Language) – An XML-based protocol used for Single Sign-On (SSO), enabling secure exchange of authentication and authorization data between an identity provider and a service provider (e.g., logging into one service using credentials from another). Commonly used for apps to integrate seamlessly into an SSO portal. This is SSO for workforce/employees and primarily for mid-large enterprise environments. Note: Okta, Entra ID, or any other IdP’s end-user dashboard login page is not SAML, SAML is between the IdP and applications.

SCIM (System for Cross-domain Identity Management) – A protocol for automating the provisioning and management of user identities across systems, streamlining user data synchronization between identity providers and applications. For example, SCIM makes onboarding someone through Okta seamless by automatically creating their user account in connected applications, such as Slack, Google Workspace, or Salesforce, with the appropriate roles and permissions. Similarly, when the user leaves the organization, SCIM ensures their accounts are promptly deactivated across all integrated systems, reducing the risk of orphaned accounts and improving security.

LDAP (Lightweight Directory Access Protocol) – A protocol for accessing and maintaining distributed directory information services over a network, commonly used for managing and authenticating users in directory services like Active Directory.

Kerberos – A secure protocol for authenticating users in a network. It uses tickets to verify identities and is widely used in environments like Active Directory to manage access. It also relies on symmetric key cryptography and a trusted third-party Key Distribution Center (KDC), which helps in preventing replay attacks and ensuring secure, single sign-on (SSO) experiences across networked services.

WS-Federation (WS-Fed or formally Web Services Federation) – A protocol that enables Single Sign-On (SSO) across multiple domains and organizations, allowing users to access different services with one login. It is part of the broader WS-* standards family supported in Windows Server and Active Directory Federation Services (ADFS).

WebAuthn (Web Authentication) – An open authentication standard that enables passwordless authentication using public key cryptography. It allows users to authenticate using biometrics, mobile devices, or FIDO security keys. WebAuthn is the web-facing component of FIDO2 that enables browsers to interact with authenticators.

NTLM (NT LAN Manager) – Microsoft’s challenge-response authentication protocol for Windows networks, providing basic user authentication and session security. It’s severely limited by vulnerabilities to pass-the-hash attacks, lack of mutual authentication, and weak MD4 hashing. The protocol works through a simple flow where a client requests access, the server issues a challenge, the client responds with a password hash, and the server validates to grant or deny access. Largely replaced by Kerberos for Active Directory authentication in modern systems.

XACML (eXtensible Access Control Markup Language) – An authorization standard that defines a declarative fine-grained, attribute-based access control policy language, an architecture, and a processing model describing how to evaluate access requests according to the rules defined in policies. It provides a way to express and enforce complex access control policies in a standardized way.

SPML (Service Provisioning Markup Language) – An XML-based framework for managing the provisioning and allocation of identity information and system resources within and between organizations. It standardizes how organizations exchange user, resource, and service provisioning information across different platforms. Considered legacy technology, largely superseded by SCIM.