"Which IAM standards should I use?" What does an IAM decision-maker have to weigh up?
The decision is a trade-off between four factors: the available IAM software products (existing products, budget, on-premises versus cloud), the capabilities of the existing IT applications, the skills of the developers and the skills of the IT administration.
* The choice of standards is a trade-off, not a technical beauty contest. *
There is no objectively best standard; the right choice depends on the situation:
- IAM software products: which products are already in place, what the budget allows, and fundamental questions such as on premises versus cloud. A company with Active Directory and a Microsoft cloud contract has already made many decisions.
- Capabilities of existing IT applications: a standard is useless if the applications cannot speak it. If the ERP system only supports LDAP, the shiny OIDC plan needs a gateway or must wait.
- Developers' skills: in-house developers must be able to connect applications correctly. A protocol nobody on the team understands will be implemented insecurely.
- IT administration's skills: someone must operate, monitor and troubleshoot the chosen technology every day.
Combined with the observations on how standards develop (none is final, lightweight wins), this leads to a pragmatic rule: choose widely supported, lightweight standards that fit what you already have, and keep the architecture open for the next migration.
Go deeper:
eCH-0107: design principles for IAM — principles 3, 9 and 10 ask for decoupled IAM services, economical operation and an internationally interoperable architecture (in German).