Guides
Identity and API security topic guides
Each guide starts with a direct answer, then explains how the topic works today, which standards apply and what to check in your own systems.
Identity and access management is a set of jobs: proving who someone is, deciding what they may do, connecting organizations, keeping accounts in sync and keeping a record. Around those jobs sit topics that cut across them, like securing OAuth, handling mobile devices and signing in customers with social accounts. Pick a guide below, or start with the IAM building blocks.
- Topic guide
OAuth security: what to get right
A practical OAuth 2.0 security guide based on RFC 9700: choose the right flow, use PKCE and state, validate redirects, limit tokens, protect refresh tokens and APIs.
- Topic guide
Cloud security through identity
Identity-centered cloud security: shared responsibility, SSO and SCIM for SaaS, least privilege in IaaS, workload identities, hybrid connections and logging.
- Guides
IAM building blocks
The five building blocks of identity and access management explained: authentication, authorization, federation, provisioning and audit, with standards for each.
- Topic guide
The social corridor: identity brokering explained
How an identity broker sits between apps and many identity providers, turning social logins, enterprise SAML and OIDC into one consistent token.
- Topic guide
Information security for identity systems
How to protect identity infrastructure itself: signing keys, TLS, admin access, patching, secrets, logging and incident response for IdPs and authorization servers.
- Topic guide
Mobile app security and OAuth
Mobile security for identity teams: OAuth for native apps with PKCE, token storage, app attestation, device management, BYOD and conditional access.
- Topic guide
OAuth downgrade attacks
How attackers push OAuth flows to weaker options: PKCE downgrade, plain challenges, implicit fallback, server mix-up, and the checks that stop them.
- Topic guide
Social login, done properly
How to add social login to an app: choosing providers, OpenID Connect integration, what data to request, account linking, consent and handling provider changes.
IAM building blocks
- IAM building block
Authentication: proving who someone is
How authentication works in 2026: knowledge, possession and inherence factors, phishing-resistant MFA, passkeys, NIST assurance levels and service authentication.
- IAM building block
Authorization: deciding what is allowed
How authorization works: role-based and attribute-based access control, XACML's PDP and PEP, policy-as-code engines, OAuth scopes, and where checks belong.
- IAM building block
Audit: knowing who did what
What identity audit covers: sign-in and admin logs, access reviews and certification, separation of duties, retention, and the evidence auditors ask for.
- IAM building block
What is identity federation?
How identity federation works: identity providers and relying parties, SAML 2.0 and OpenID Connect trust, metadata, certificates and common pitfalls.
- IAM building block
Provisioning and SCIM
How user provisioning works: joiner, mover and leaver processes, SCIM 2.0 requests, connectors, just-in-time provisioning and reliable deprovisioning.
Questions
Are these guides a consulting offer?
No. The addresses once belonged to a consultancy's service pages; on this site they hold independent educational guides. Nothing here is for sale.
How current are the guides?
Each guide shows the date it was last updated and cites its primary sources, such as RFCs and OASIS or OpenID Foundation specifications. If you find something out of date, email contact@twobotechnologies.com.