Identity Standards Bodies and Communities
The organizations that write and maintain the standards this site explains. Twobo Technologies has no partnerships; this page simply describes who does what.
Identity works because competitors agree on protocols. These are the main places where that agreement is reached. Twobo Technologies is not a member of, partner of or affiliated with any of them.
Who writes which standards?
| Organization | Type | Key work |
|---|---|---|
| IETF (OAuth WG and others) | Open standards body | OAuth 2.0 (RFC 6749), PKCE (RFC 7636), JWT (RFC 7519), RFC 9700, OAuth 2.1 draft, SCIM (RFC 7643/7644), TLS |
| OpenID Foundation | Non-profit foundation | OpenID Connect, FAPI, Shared Signals (CAEP, RISC), OpenID Federation, certification |
| OASIS | Standards consortium | SAML 2.0, XACML 3.0 |
| W3C | Web standards consortium | WebAuthn, Verifiable Credentials, Federated Credential Management |
| FIDO Alliance | Industry association | FIDO2 / CTAP, passkey guidance, certification |
| Kantara Initiative | Non-profit | Identity assurance frameworks, conformity assessment, privacy-related specifications |
| IDPro | Professional association | Body of knowledge, CIDPRO certification for identity professionals |
| NIST | US government agency | SP 800-63 digital identity guidelines, SP 800-207 zero trust |
How does the IETF work?
Through working groups with public mailing lists, documents tracked on the datatracker, and three meetings a year.
Drafts are Internet-Drafts until approved; approved documents become RFCs. The OAuth working group handles OAuth extensions; other groups handle TLS, JOSE (the family behind JWT) and SCIM.
How does the OpenID Foundation work?
Working groups develop specifications, which become final after public review and member votes; a certification program tests implementations.
OpenID Connect Core 1.0 was finalized in 2014 and published as ISO/IEC 26131 in 2024.
Where do practitioners meet?
At the Internet Identity Workshop, Identiverse, the European Identity and Cloud Conference, FIDO's Authenticate and IETF meetings.
See identity conferences worth following and API security events and communities. For definitions of the terms these bodies use, see the glossary.
Common questions
Can anyone take part in standards work?
Largely, yes. IETF participation is open to individuals through mailing lists and meetings. The OpenID Foundation's working groups require signing a contribution agreement but are open to non-members. OASIS and W3C participation usually goes through member organizations, with public comment periods.
Which body publishes SAML?
OASIS. SAML 2.0 was approved as an OASIS Standard in March 2005, developed by the Security Services technical committee.