Platform category · 2 min read
Other tools in the identity stack
Short answer
Around the core identity platforms sit supporting tools: directories, PKI and certificate lifecycle management, hardware security modules and cloud key management, secrets managers, privileged access management, and testing and debugging tools such as token decoders and protocol test suites.
Key takeaways
- Key management and certificate lifecycle tools prevent the most common federation outages.
- Privileged access management protects the admin accounts of identity systems themselves.
- Keep debugging tools local: tokens and assertions are credentials.
No identity platform works alone. A handful of supporting tools decide whether it runs smoothly or has a 3 a.m. outage when a certificate expires.
Which supporting tools matter most?
Key and certificate management, secrets management, privileged access and testing tools.
| Tool type | Role in IAM |
|---|---|
| Directory (AD, LDAP, cloud directory) | Store of identities and attributes |
| PKI and certificate lifecycle management | TLS, SAML signing, mTLS client certificates, renewal alerts |
| HSM / cloud KMS | Protect token signing keys |
| Secrets manager | Client secrets, SCIM tokens, bind passwords |
| Privileged access management | Admin access to IdPs, directories, cloud consoles |
| Security token service | Token issuance and exchange for legacy and modern services |
| Conformance suites | Test OIDC, FAPI and other implementations |
| Local debuggers | Decode tokens and assertions safely |
What testing and debugging tools help?
Browser developer tools, local decoders, protocol conformance suites and proxy tools in test environments.
The browser's network panel captures SAML POSTs and OAuth redirects. Decode what you capture locally: the SAML Decoder, JWT Decoder, PKCE Generator, Authorization URL Builder and Security Header Builder on this site all run in your browser. The OpenID Foundation's conformance suite tests OpenID Connect and FAPI implementations against the specifications.
Where do older product categories fit?
Many have merged into platforms: web access management into access management suites, STS into token endpoints, provisioning servers into IGA.
If you maintain an older component, the neighboring pages explain its modern equivalent: SiteMinder for web access management, identity management systems for provisioning, and API gateways for XML and API security gateways.
Questions
What is a security token service?
A component that issues, validates and exchanges security tokens. The term comes from WS-Trust, where an STS issued SAML tokens for SOAP services; OAuth token endpoints with token exchange (RFC 8693) play the same role today.
Are online JWT decoders safe?
Only if they work entirely in your browser and you trust the page. Prefer tools that state they send nothing, or offline tools. Ours run locally, and you should still avoid pasting live production tokens anywhere.