Agencies building stand-alone digital credentials should consider compatibly. Provisioning SCIM SPML The use of JSON over REST for user (Legacy) management is a common direction. SCIM provisioning protocol uses this design pattern, but it has seen limited adoption. SPML (the previous standard) has seen low adoption for federation and directory Federated OpenID OpenID Open ID Connect and OAuth have emerged as authentication Connect Connect the clear winners for providing authentication completes and authorisation for API-based applications. SAML with SAML There are no competing protocols for OAuth and for Web SSO Connect; organisations can confidently develop applications using these protocols. ODIC is preferred, however see decision (Legacy) framework as the most appropriate protocol per use case. Note: The proposed NAPPS standard for mobile device SSO was officially dropped late 2015 Note: OAuth can be used to achieve federated authentication (typically for social media logins), although the standard is intended for API authorisation/resource delegation. Identity JSON As above Identity assertion token formats align to the assertions Identity Suite federated authentication standard selected (JWT) above. SAML Assertion API OAuth/ WS-Trust OpenID Connect supports a subset of OAuth authorisation OpenID (Legacy) flows (in some implementations, all OAuth flows Connect are supported) WS-Trust to protect SOAP-based Web Services considered legacy, given the explosion of REST-based (and the corresponding API’s uptake of OAuth). Delegated OAuth None See decision framework as to the most access and appropriate protocol per use case. UMA consent Authorisation XACML/ ALFA Wherever possible, use the modern JSON via JACML REST profile of XACML 3.0 (referred to as JACML).
Agencies building stand-alone digital credentials should consider compatibly. Provisioning SCIM SPML (Legacy) The use of JSON over REST for user management is a common direction. SCIM provisioning protocol uses this design pattern, but it has seen limited adoption. SPML (the previous standard) has seen low adoption for federation and directory Federated authentication OpenID Connect SAML OpenID Connect completes with SAML for Web SSO (Legacy) Open ID Connect and OAuth have emerged as the clear winners for providing authentication and authorisation for API-based applications. There are no competing protocols for OAuth and Connect; organisations can confidently develop applications using these protocols. ODIC is preferred, however see decision framework as the most appropriate protocol per use case. Note: The proposed NAPPS standard for mobile device SSO was officially dropped late 2015 Note: OAuth can be used to achieve federated authentication (typically for social media logins), although the standard is intended for API authorisation/resource delegation. Identity assertions JSON Identity Suite (JWT) SAML Assertion As above Identity assertion token formats align to the federated authentication standard selected above. API authorisation OAuth/ OpenID Connect WS-Trust (Legacy) OpenID Connect supports a subset of OAuth flows (in some implementations, all OAuth flows are supported) WS-Trust to protect SOAP-based Web Services considered legacy, given the explosion of REST-based API’s (and the corresponding uptake of OAuth). Delegated access and consent OAuth UMA None See decision framework as to the most appropriate protocol per use case. Authorisation XACML/ JACML ALFA Wherever possible, use the modern JSON via REST profile of XACML 3.0 (referred to as JACML).
3.-Federated-identity-blueprint-Standards-v100.docx