Which important authentication protocols exist, and what is each one used for?
For the web: OAuth 2.0 (delegated authorisation), OpenID Connect (authentication on top of OAuth) and SAML (XML-based single sign-on); for directories and networks: LDAP (directory access) and Kerberos (ticket-based network authentication).
* Two families: web protocols that move tokens or assertions through the browser, and directory or network protocols inside an organisation. *
| Protocol | Family | Purpose |
|---|---|---|
| OAuth 2.0 | Web and mobile | Lets a user give a third-party application limited access to their resources (delegated authorisation). |
| OpenID Connect (OIDC) | Web and mobile | Extension of OAuth 2.0 that adds authentication: the application learns who the user is. |
| SAML | Web | XML-based single sign-on: an identity provider sends signed assertions about the user to web applications. |
| LDAP | Directory | Network protocol for reading and managing directory services; often used to check user credentials in company networks. |
| Kerberos | Network | Ticket-based authentication inside a network, the default in Windows domains. |
A useful mental split: OAuth, OIDC and SAML were designed for the internet, where the user's browser carries messages between parties that may belong to different organisations. LDAP and Kerberos grew up inside an organisation's network. In practice they combine: an OpenID Provider often checks the password against an LDAP directory behind the scenes.
Go deeper:
Single sign-on (Wikipedia) — how SAML, OIDC and Kerberos each implement SSO.- oose: OAuth, OpenID Connect und JWT, wie hängt das alles zusammen? (Teil 1) — how the web protocols relate to each other (in German).