Auth protocols

Twenty ways to prove who you are, what each one is for, and what it costs to run.

Twenty protocols in seven groups, each card answering the same six questions. The ones that put the secret itself on the wire, which are HTTP Basic, an LDAP bind and RADIUS. The ones for a caller with no human behind it, which are an API key, a signed request and mTLS. What the second request carries, where a session id is a question for the store and a JWT is an answer you cannot take back. The OAuth grants, which say what an app may do and never who you are. The three that make single sign-on work, which are Kerberos, SAML and OpenID Connect. The three that drop the password, of which only a passkey survives a convincing copy of your login page. And the two that outlast the login, which are SCIM taking a leaver away and workload identity federation leaving no key to steal. Each carries a cost from 1, an afternoon, to 5, a system with an owner.

← All cheatsheets