What are the Major Authentication Foundations?

What are the Major Authentication Foundations?

What are the major authentication foundations available to enterprises? How do they differ, and why do those differences matter? 

When we discuss authentication, we tend to do so in the ways that your users may most directly interact with it; usually, they’ll encounter it through multifactor authentication (MFA) factor inputs and through other requests in cases of step-up authentication.

However, your IT security team will more frequently encounter your identity management through one of the major authentication foundations. These provide the rock upon which you build your cybersecurity, especially given that identity forms the foundation of modern cybersecurity platforms.  

These foundations differ in several ways, and some might be more suited to certain use cases. We learned about them and more in the “Authentication Survival Guide,” a whitepaper published by Auth0 as part of its Identity White Paper Bundle. Here’s what we gleaned about the foundations of so many authentication protocols and how they interact in the IT environment. 

What are the Major Authentication Foundations? 

OAuth 2.0

OAuth 2.0 is an authorization framework that enables an application to obtain access to HTTP-based resources usually within the domain of an unrelated application and that also may be associated with a given user within that domain. It solves the problem of delegated access without requiring credentials sharing. Authorization servers, client applications, and resource servers all utilize OAuth 2.0. 

OpenID Connect

OpenID Connect can be described as an extension to OAuth2 that provides clear guidance on how to achieve a functional and secure authentication system. It clears up grey areas in authentication that OAuth2.0 struggles with, clearing up conflicting implementations. It also formalizes the means by which an identity provider can make new factors available. 


The Security Assertion Markup Language (SAML) achieves web browser-based SSO across different domains.This is a standard that defines a set of structured messages and how these messages can be used by an application to perform authentication requests. The authentication request creates a token that can transfer across security domains. 


Another SSO-based standard, WS-Federation defines the necessary web interactions required between two systems in order to achieve SSO. 

Enterprise Protocols

This refers to in-house, custom-made authentication protocols and foundations, which proliferated before the advent of more available authentication tools and services. While certainly not as common as it once was, enterprise protocols actually contributed to the rise of Single Sign-On as a technology. 

Of course, these major authentication foundations may all be a part of your IT environment, as different applications. You’ll need to be aware of what applications and servers use what foundations and how your identity and access management. Only by finding a solution that can integrate with all possible foundations can you achieve optimal information security. 

You can learn more in the “Authentication Survival Guide,” a whitepaper published by Auth0 as part of its Identity White Paper Bundle. Also, check out the Solutions Review Solutions Suggestion Engine or the Identity Management Buyer’s Guide for the latest on the identity and access management market and its most prominent vendors. 

Ben Canner