Which standards serve directory services and provisioning, and how do they split between on-premises and cloud?
On premises: X.500 (replaced by LDAP), LDAP itself, plus the XML standards SPML (provisioning) and XACML (access policies). In the cloud: SCIM for provisioning and OData 4 as a REST data protocol.
* Directory and provisioning standards: XML-era on-premises standards below, REST/JSON cloud standards above. *
These standards answer a different question from login protocols: not "who is logging in right now?" but "where are identities stored, and how do accounts and permissions get to the applications?"
| Standard | Since | Purpose | Area |
|---|---|---|---|
| X.500 | 1988 (ITU-T) | Global directory model and access protocol (DAP) | On premises, displaced by LDAP |
| LDAP | 1993 (IETF) | Lightweight protocol to read and write directory entries | On premises; the core of Active Directory |
| SPML | 2003 (OASIS) | XML protocol for provisioning accounts into target systems | On premises |
| XACML | 2003 (OASIS) | XML language for attribute-based access policies | On premises |
| SCIM | 2011, v2.0 2015 (IETF) | REST/JSON API to create, update and delete users and groups | Cloud |
| OData 4 | 2014 (OASIS) | REST protocol for querying data, used for example by Microsoft Graph | Cloud |
The split is not only about location. The on-premises standards come from the XML and SOAP era and are comprehensive and complex; the cloud standards are REST and JSON based and deliberately lightweight. SCIM was explicitly designed to be a simpler, more widely adopted successor to earlier attempts such as SPML.
Go deeper:
System for Cross-domain Identity Management (Wikipedia) — SCIM's purpose and how it builds on SPML and LDAP to be simpler.- RFC 7644: SCIM protocol — the SCIM 2.0 REST protocol itself.
- XACML (Wikipedia) — the policy language, its versions and its PDP/PEP architecture.