IAM Protocols/Fundamental Approaches to Identity and Access Management

         As information technology has taken on a greater role in organisational business processes, controlling access to information resources has become a critical security requirement. In the traditional approach, each application has its own username and password system, forcing users to manage numerous credentials and organisations to administer separate user databases.

       The IAM approach aims to solve this problem through centralised identity management, authentication, and authorisation mechanisms. The primary goal of IAM is not only to determine “who the user is,” but also to control “which resource the user may access, under what conditions, and with what level of privilege.”

IAM architectures use different protocols for different requirements. Some protocols focus on authentication and authorisation, while others focus on synchronising user information or providing directory services.

 

1. Core Components of IAM

To understand IAM systems, three fundamental concepts must be distinguished:

• Identity: A digital entity that identifies a user, application, service, or device.
• Authentication: Verifying whether an entity truly possesses the identity it claims.
• Authorisation: Determining which resources an authenticated entity can access and which actions it can perform.

For example, when an employee signs in to a corporate application with a username and password, authentication takes place. Allowing that employee to view only reports belonging to their own department is an authorisation decision.

In addition to these processes, IAM systems provide functions such as user lifecycle management, access policy enforcement, audit logging, and Single Sign-On (SSO).

 

2. SAML

Security Assertion Markup Language (SAML) is an XML-based authentication and authorisation standard used particularly in enterprise environments. SAML plays an important role in Single Sign-On (SSO) scenarios by enabling a user’s identity information to be conveyed to a service provider.

A SAML architecture mainly involves two parties:

• Identity Provider (IdP): The system that authenticates the user.
• Service Provider (SP): The application or service that the user wants to access.

For example, when an employee wants to access a corporate application, the application may redirect authentication to the organisation’s Identity Provider. After the user is successfully authenticated, the IdP creates a SAML assertion containing information about the user’s identity. The Service Provider validates this assertion and allows the user to access the system.

One of SAML’s key advantages is that it enables users to access different corporate applications without repeatedly entering passwords. It has been widely used, especially in enterprise SaaS applications and SSO architectures.

However, because SAML is XML-based, it can be more complex in some scenarios than newer, web- and API-oriented approaches such as OAuth 2.0 and OpenID Connect.

 

3. OAuth 2.0

OAuth 2.0 is a protocol primarily used for authorisation. One of its key characteristics is that it allows an application to access specific resources without directly obtaining the user’s password.

For example, a user may want to allow an application to access a particular cloud-storage resource on their behalf. Instead of giving the application their password, the user can authorise access through OAuth 2.0 using an access token with limited privileges.

An OAuth 2.0 architecture generally includes the following components:

• Resource Owner: The user who owns the resource.
• Client: The application that wants to access the resource.
• Authorisation Server: The server that performs the authorisation process.
• Resource Server: The server that hosts the protected resource.

Using access tokens in OAuth 2.0 eliminates the need to share the user’s password with third-party applications. The ability to restrict tokens to specific scopes is also an important security advantage.

However, OAuth 2.0 by itself is not a standard authentication protocol. To verify a user’s identity in a standardised way, it is generally used together with a layer such as OpenID Connect.

 

4. OpenID Connect

OpenID Connect (OIDC) is an authentication protocol built on top of OAuth 2.0. It is widely used to authenticate users in modern web and mobile applications.

OIDC uses OAuth 2.0 authorisation capabilities and adds an identity layer. For this purpose, it primarily uses an ID Token, which is generally formatted as a JSON Web Token (JWT).

With OIDC, an application can authenticate a user through an Identity Provider. For example, when a user wants to sign in to an application, they are redirected to the sign-in page of the organisation’s or an external identity provider. After authentication is completed, the application can obtain the required information about the user’s identity.

Key advantages of OIDC include:

• It is compatible with modern web and mobile applications.
• It can be easily integrated with REST APIs and microservice architectures.
• It works together with OAuth 2.0.
• It uses JWT- and JSON-based structures.
• It can be used in SSO scenarios.

Because of these characteristics, OIDC has become an important standard in modern IAM architectures.

 

 

5. LDAP

Lightweight Directory Access Protocol (LDAP) is a protocol for storing and querying user and resource information in a hierarchical directory structure.

LDAP should not be considered in the same category as SAML or OIDC. While SAML and OIDC are mainly used for authentication and federation processes, LDAP is used to manage user and group information in a centralised directory.

An organisation’s LDAP directory may contain the following information:

• User accounts
• Groups
• Department information
• Email addresses
• Organizational information
• System resources

LDAP has been used for many years, particularly in on-premises networks and traditional enterprise applications. In modern cloud environments, hybrid architectures that integrate LDAP directories with cloud IAM systems are also common rather than replacing LDAP entirely.

 

6. Kerberos

Kerberos is a network authentication protocol developed to authenticate users in secure network environments. It plays an especially important role alongside Active Directory in enterprise Windows environments.

One of Kerberos’s fundamental characteristics is that users rely on tickets issued by a trusted central authority instead of sending their passwords to every service.

At the centre of the Kerberos architecture is the Key Distribution Centre (KDC). The KDC generally operates with Authentication Server and Ticket Granting Server components.

After signing in to the system, the user can obtain a Ticket Granting Ticket (TGT) as a result of the authentication process. The user can then obtain the required service tickets for the services they want to access.

This approach prevents the password from being repeatedly transmitted over the network and can provide a Single Sign-On-like experience.

7. SCIM

System for Cross-domain Identity Management (SCIM) is a standard used to automatically create, update, and delete user and group information across different systems.

SCIM is particularly important for provisioning and deprovisioning processes.

For example, consider a new employee joining an organisation. When a user account is created for the employee in the IAM system, SCIM can automatically create corresponding accounts in various SaaS applications.

Similarly, when the employee leaves the organisation, the account can be automatically removed from or disabled in the relevant applications.

This capability reduces the operational burden of manual account management, especially in organisations that use many cloud applications, and helps reduce the risk of unauthorised access.

 

8. Comparison of Protocols

 

9. Security Approach in IAM

Correctly configuring IAM protocols is important, but so is properly enforcing security policies. Today, IAM architectures are often considered together with the Zero Trust approach.

In a Zero Trust approach, a user or device is not considered trustworthy solely because it is inside the corporate network. Access requests can be evaluated according to factors such as user identity, device posture, location, risk level, and the resource being requested.

In addition, multi-factor authentication (MFA), strong password policies, short-lived tokens, appropriate scope usage, regular access reviews, and centralised logging are important elements of IAM security.

Applying the Least Privilege principle is particularly critical for highly privileged accounts. Granting user or service accounts only the permissions required to perform their duties limits the impact of a potential account compromise.

 

10. Conclusion

IAM is one of the fundamental components of secure access in modern information technology infrastructures. Protocols such as SAML, OAuth 2.0, OpenID Connect, LDAP, Kerberos, and SCIM serve different requirements and enable comprehensive IAM architectures.

SAML is prominent in enterprise federation and SSO scenarios; OAuth 2.0 in API authorisation; OpenID Connect in authentication for modern applications; LDAP in centralised directory management; Kerberos in enterprise network authentication; and SCIM in user lifecycle and provisioning processes.

Today, it is not sufficient to view IAM systems merely as username and password management. A modern IAM approach requires a holistic security architecture that combines federation, multi-factor authentication, centralised policy management, automated provisioning, Zero Trust, and Least Privilege principles.

In conclusion, selecting IAM protocols that match organisational requirements and configuring them correctly together with security policies both improves the user experience and significantly strengthens the security of information systems.

 

Single Sign-On (SSO)

Single Sign-On (SSO) allows a user to access multiple authorised applications without entering a password again after authenticating once.