Which widely used IAM standards have been superseded, and by what?

• OAuth 1 → OAuth 2
• SAML 1 → SAML 2
• NTLM → Kerberos (in Windows domains)
• X.500 directory access (DAP) → LDAP

Each succession has a reason worth knowing:

• OAuth 1.0 → OAuth 2.0: OAuth 1 required every request to be cryptographically signed, which was hard to implement correctly. OAuth 2.0 (RFC 6749, 2012) relies on TLS and bearer tokens, is far simpler for developers, and formally obsoletes RFC 5849 (OAuth 1.0).
• SAML 1.x → SAML 2.0: SAML 2.0 (2005) merged SAML 1.1 with the Liberty Alliance's ID-FF and Shibboleth's extensions into one federation standard. SAML 1 is effectively obsolete.
• NTLM → Kerberos: Microsoft made Kerberos the preferred protocol with Windows 2000 and Active Directory; NTLM stayed as a fallback. In June 2024 Microsoft officially deprecated all versions of NTLM and recommends replacing NTLM calls with Negotiate (which prefers Kerberos).
• X.500 → LDAP: the X.500 directory protocols used the heavyweight OSI network stack. LDAP, the Lightweight Directory Access Protocol (1993), let ordinary TCP/IP clients reach directories and became the de-facto standard. Note that the X.500 series itself is still maintained by ITU-T, and its X.509 part underpins every TLS certificate; what was displaced in practice is X.500's access protocol and full X.500 directories.

Tip: In each pair the successor is simpler or better suited to the network of its time. That is the pattern behind the next card.

Go deeper:

• RFC 6749: The OAuth 2.0 Authorization Framework — the standard that obsoletes OAuth 1.0 (RFC 5849).
• Microsoft: Deprecated features in the Windows client — the June 2024 entry deprecating all NTLM versions.
• X.500 (Wikipedia) — the DAP protocol, its OSI dependency and LDAP as the alternative.