Introduction to Identity and Access Management (IAM)

When I first started learning about authentication and authorization, I found the terminology around Identity and Access Management (IAM) quite confusing. Terms like identity, authentication, authorization, roles, permissions, Identity Providers (IdPs), and IAM platforms were often used together, and it was difficult to understand how they were connected.

One of the first misunderstandings I had was thinking that IAM is a framework. For example, when we talk about web development, we have frameworks such as React, Angular, or Spring Boot. In machine learning, we have frameworks and libraries such as TensorFlow and PyTorch. So, naturally, it is easy to assume that IAM is another framework like those.

However, IAM is not a framework or a specific technology. IAM is a domain in cybersecurity that focuses on managing digital identities and controlling access to resources. Similar to how web development is a domain that includes different technologies, or how machine learning is a domain that includes different algorithms and tools, IAM is a domain that contains many concepts, standards, and solutions.

IAM as a Domain, Not a Framework

For example, in web development, we have different tools and frameworks that help us build applications:

Similarly, IAM is a domain that contains concepts and technologies such as:

The purpose of IAM is to solve a fundamental security problem:

"Who is accessing a resource, and what are they allowed to do?"

Authentication vs Authorization

To understand IAM, we first need to separate two important concepts: authentication and authorization.

Authentication answers:

"Who are you?"

For example, when a user logs into an application using an email and password, Google login, or multi factor authentication, the system is verifying the user's identity.

Authorization answers:

"What are you allowed to do?"

After the user is authenticated, the system needs to decide what actions they can perform. A normal employee may be allowed to view documents, while an administrator may be allowed to create users, manage permissions, and modify system settings.

Here is how the two concepts fit together in a typical login flow:

IAM combines these concepts and provides a structured way to manage identities and access throughout an organization.

The Role of an Identity Provider

Another important concept inside IAM is the Identity Provider (IdP). An IdP is responsible for authenticating users and providing identity information to applications. For example, when you use "Sign in with Google", Google acts as the Identity Provider. Your application does not need to store your Google password; it trusts Google to verify your identity and provide information about the authenticated user.

Standards and Platforms

In modern applications, IAM is implemented using different standards and platforms. Standards such as OAuth 2.0, OpenID Connect (OIDC), and SAML define how identity and access information should be exchanged between systems. Platforms such as Auth0, Keycloak, Okta, and Microsoft Entra ID provide ready made solutions that implement these standards.

Bringing It Together

Understanding IAM became much easier for me when I stopped thinking of it as a single framework and started seeing it as a complete security domain containing multiple concepts, standards, and technologies that work together to manage digital identities and access control.

In the simplest terms:

IAM is the discipline of managing who users and systems are, proving their identity, and controlling what they are allowed to access.