How have authentication and authorisation standards developed over time, and in which deployment areas is each mainly used?
On premises: Kerberos and NTLM (from the late 1980s and 1990s). Web browser: SAML 1 then SAML 2, with Shibboleth. Web for smartphones and apps: OAuth 1 then OAuth 2, with OpenID Connect on top. Newest: FIDO and WebAuthn ("FIDO keys"). The newer the standard, the more it targets the cloud.
* Authentication and authorisation standards by era and deployment area; a cross marks a deprecated version. *
Reading the development as three bands, from the inside of the company network outwards:
- On premises (private cloud): Kerberos (MIT, 1986; version 5 published in 1993) and Microsoft's NTLM (early 1990s). Both assume a closed corporate network with a domain controller.
- Web, in the browser: SAML 1 (2002) was quickly replaced by SAML 2 (2005), which brought browser single sign-on across organisations. Shibboleth, the open-source SAML implementation, became the standard in universities.
- Web, for smartphones and apps: OAuth 1 (2007) was replaced by OAuth 2 (RFC 6749, 2012), which delegates API access with tokens; OpenID Connect (2014) adds an identity layer on top. Most recently, FIDO and WebAuthn brought phishing-resistant, public-key login with hardware keys and passkeys.
The direction is clear: from closed networks towards the open Internet and the cloud, and from passwords sent to a server towards tokens and public-key cryptography. But the older bands have not disappeared; they coexist with the new ones.
Go deeper:
Kerberos (protocol) (Wikipedia) — history from Project Athena to version 5 and Windows.- SAML (Wikipedia) — the history from SAML 1.0 (2002) to SAML 2.0 (2005).
- OAuth (Wikipedia) — from the 2007 OAuth Core 1.0 to OAuth 2.0 and OpenID Connect.