đ Authentication Protocols
Authentication protocols are the rules and mechanisms that verify identity so users, devices, and applications can securely access resources. They form the backbone of SSO, MFA, SaaS access, hybrid identity, and cloud authentication.
The concise takeaway: authentication protocols define how a user proves who they are â locally, onâprem, or in the cloud.
1. Kerberos
Section titled â1. KerberosâKerberos is the primary authentication protocol for Active Directory.
It uses tickets instead of passwords to authenticate users securely.
Key concepts:
- Key Distribution Center (KDC)
- Ticket Granting Ticket (TGT)
- Service tickets
- Mutual authentication
Kerberos is fast, secure, and ideal for internal enterprise networks.
2. LDAP
Section titled â2. LDAPâLDAP is a directory access protocol used to query and authenticate against AD DS or other directory services.
Used for:
- Legacy applications
- Bind authentication
- Directory lookups
LDAP is often paired with Kerberos in Windows environments.
3. SAML 2.0
Section titled â3. SAML 2.0âSAML is an XMLâbased protocol used for webâbased Single SignâOn (SSO).
Roles:
- Identity Provider (IdP) â Entra ID, Okta
- Service Provider (SP) â Salesforce, AWS, Slack
SAML enables browserâbased SSO without sending passwords to apps.
4. OAuth 2.0
Section titled â4. OAuth 2.0âOAuth 2.0 is an authorization framework used by modern web and mobile apps.
It issues access tokens that allow apps to act on behalf of users.
Common flows:
- Authorization Code
- Client Credentials
- Device Code
- Refresh Tokens
OAuth is the foundation of modern API security.
5. OpenID Connect (OIDC)
Section titled â5. OpenID Connect (OIDC)âOIDC builds on OAuth 2.0 to provide authentication (not just authorization).
It issues:
- ID Tokens (JWTs)
- Access Tokens
- Refresh Tokens
OIDC is used by Microsoft Entra ID, Google Identity, Okta, Auth0, and nearly all modern SaaS platforms.
6. RADIUS
Section titled â6. RADIUSâRADIUS is used for network authentication:
- WiâFi
- VPN
- Firewalls
- Switches
- NAC systems
It integrates with AD DS or cloud identity providers to enforce MFA and conditional access.
7. NTLM
Section titled â7. NTLMâNTLM is an older Windows authentication protocol.
Still used for:
- Legacy systems
- SMB shares
- Older applications
Modern environments prefer Kerberos, but NTLM remains for backward compatibility.
8. FIDO2 / WebAuthn
Section titled â8. FIDO2 / WebAuthnâFIDO2 enables passwordless authentication using:
- Security keys (YubiKey)
- Windows Hello
- Platform authenticators
It provides phishingâresistant MFA and is becoming a modern standard.
9. Certificateâbased Authentication
Section titled â9. Certificateâbased AuthenticationâUsed for:
- VPNs
- WiâFi (EAPâTLS)
- Device trust
- Smart cards
Certificates provide strong, cryptographic identity verification.
How These Protocols Work Together
Section titled âHow These Protocols Work TogetherâModern identity systems combine multiple protocols:
- Kerberos + LDAP â onâprem AD DS
- OAuth2 + OIDC â cloud apps and APIs
- SAML â enterprise SaaS SSO
- RADIUS + certificates â WiâFi and VPN
- FIDO2 â passwordless MFA
- NTLM â legacy fallback
Hybrid identity environments rely on all of them.
Why Authentication Protocols Matter
Section titled âWhy Authentication Protocols MatterâThey enable:
- SSO across cloud and onâprem
- MFA enforcement
- Conditional access
- Passwordless authentication
- Secure API access
- Device trust
- Zeroâtrust architectures
Without them, identity becomes fragmented and insecure.
Summary
Section titled âSummaryâAuthentication protocols define how users and devices prove their identity.
The major families include:
- Kerberos
- LDAP
- SAML
- OAuth2
- OIDC
- RADIUS
- NTLM
- FIDO2
- Certificateâbased authentication
Together, they power modern identity, SSO, MFA, and secure access across enterprise and cloud environments.