In-Depth Guides on Identity and API Security
The long-form material on this site, grouped by topic. Everything is free to read on the page; there are no downloads behind forms.
These guides go deeper than a blog post: each starts with a short answer, explains how the topic works today and cites primary sources. If you are new to the field, read them in this order: authentication, federation, OAuth security, authorization, provisioning.
Topic guides
- Topic guide
OAuth security: what to get right
A practical OAuth 2.0 security guide based on RFC 9700: choose the right flow, use PKCE and state, validate redirects, limit tokens, protect refresh tokens and APIs.
- Topic guide
Cloud security through identity
Identity-centered cloud security: shared responsibility, SSO and SCIM for SaaS, least privilege in IaaS, workload identities, hybrid connections and logging.
- Guides
IAM building blocks
The five building blocks of identity and access management explained: authentication, authorization, federation, provisioning and audit, with standards for each.
- Topic guide
The social corridor: identity brokering explained
How an identity broker sits between apps and many identity providers, turning social logins, enterprise SAML and OIDC into one consistent token.
- Topic guide
Information security for identity systems
How to protect identity infrastructure itself: signing keys, TLS, admin access, patching, secrets, logging and incident response for IdPs and authorization servers.
- Topic guide
Mobile app security and OAuth
Mobile security for identity teams: OAuth for native apps with PKCE, token storage, app attestation, device management, BYOD and conditional access.
- Topic guide
OAuth downgrade attacks
How attackers push OAuth flows to weaker options: PKCE downgrade, plain challenges, implicit fallback, server mix-up, and the checks that stop them.
- Topic guide
Social login, done properly
How to add social login to an app: choosing providers, OpenID Connect integration, what data to request, account linking, consent and handling provider changes.
IAM building blocks
- IAM building block
Authentication: proving who someone is
How authentication works in 2026: knowledge, possession and inherence factors, phishing-resistant MFA, passkeys, NIST assurance levels and service authentication.
- IAM building block
Authorization: deciding what is allowed
How authorization works: role-based and attribute-based access control, XACML's PDP and PEP, policy-as-code engines, OAuth scopes, and where checks belong.
- IAM building block
Audit: knowing who did what
What identity audit covers: sign-in and admin logs, access reviews and certification, separation of duties, retention, and the evidence auditors ask for.
- IAM building block
What is identity federation?
How identity federation works: identity providers and relying parties, SAML 2.0 and OpenID Connect trust, metadata, certificates and common pitfalls.
- IAM building block
Provisioning and SCIM
How user provisioning works: joiner, mover and leaver processes, SCIM 2.0 requests, connectors, just-in-time provisioning and reliable deprovisioning.
Platform and product-category guides
- Platform category
API gateways
What an API gateway does for security: token validation, rate limits, schema checks, mTLS and routing; how it differs from an authorization server.
- Product overview
Axiomatics Policy Server overview
What the Axiomatics Policy Server does: attribute-based authorization with XACML and ALFA policies, PDP, PEP and PIP, and its place in IAM.
- Platform category
Entitlement management
What entitlement management systems do: inventory permissions, govern grants and reviews, and enforce fine-grained authorization with policy engines.
- Platform category
Identity management systems
What identity management systems cover: identity governance and administration, directories, lifecycle automation, reviews, and how to evaluate them.
- Platform category
Jump-start: choosing an IAM platform
A step-by-step method for choosing an IAM platform: scenarios, deployment model, standards support, proof of concept and planning your exit.
- Platform category
Other tools in the identity stack
Supporting tools around IAM: directories, PKI and certificate management, secrets managers, HSMs and KMS, privileged access and testing tools.
- Product overview
PingFederate overview
What PingFederate is: Ping Identity's self-managed federation server for SAML, OpenID Connect and OAuth. Architecture, uses, hardening and alternatives.
- Product overview
PingOne overview
What PingOne is: Ping Identity's identity-as-a-service platform for SSO, MFA, risk and orchestration, including the Advanced Identity Cloud.
- Product overview
SiteMinder overview
What SiteMinder is: the web access management product Broadcom sells as Symantec SiteMinder. Policy server, agents, SSO sessions and migration paths.
Long-form technical articles
- The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700 (9 min)
- Calling On-Premises Web Services From the Cloud, Securely (5 min)
- OAuth 1.0a vs OAuth 2.0: What Still Matters Today (4 min)
- Implementing Modern OAuth Techniques: PAR, DPoP and More (4 min)
- Integrating OAuth With Mobile Apps: The Native App Pattern (4 min)
- OpenID to OpenID Connect: What Changed and Why It Matters (4 min)
- Using an LDAP Attribute Store in AD FS (4 min)
- SP-Initiated SSO on .NET: From WIF to Modern Libraries (4 min)
- POODLE and the End of SSLv3, TLS 1.0 and TLS 1.1 (4 min)
- Federation and Entitlement Management: How They Fit Together (4 min)