Authentication Concepts — Persona Platform

LDAP, SSO, OIDC, OAuth 2.0, SAML 2.0, and Keycloak — explained with diagrams

LDAP

LDAP — Lightweight Directory Access Protocol

LDAP is a protocol for reading and writing a hierarchical directory of entries — users, groups, and machines. It is the canonical user store for Linux systems and enterprise networks. Applications query LDAP to authenticate users and look up attributes, but LDAP itself issues no tokens and provides no web SSO.

Use Cases

• Central user store for Linux/Unix systems
• Legacy enterprise apps and VPN authentication
• Source of truth federated into Keycloak
• SSH key and sudo rule distribution

Limitations

• No web SSO — no tokens, no browser redirects
• Passwords travel as bind requests — requires TLS
• No delegation or consent flows
• Schema changes require server restart on many implementations

SSO

SSO — Single Sign-On

SSO lets a user authenticate once — to a central Identity Provider — and then access multiple applications without entering credentials again. The IdP issues a session or token after successful login; each application trusts that token rather than asking for a password. One login, one logout, one revocation point.

Key Benefits

• One credential — reduced password fatigue
• One revocation point — disable user once, locked everywhere
• Centralised audit log of all logins
• MFA enforced once, applies to all apps

Common Implementations

• Keycloak (open source, self-hosted)
• Okta, Auth0 (SaaS)
• Microsoft Entra ID (formerly Azure AD)
• Google Workspace (consumer SSO)

OIDC

OIDC — OpenID Connect

OpenID Connect is an identity layer built on top of OAuth 2.0. Where OAuth 2.0 answers “what can this app do?”, OIDC answers “who is this user?”. It introduces the ID Token — a signed JWT that carries user identity claims. Modern applications use OIDC for both authentication and obtaining user profile information.

Token Types

• ID Token — signed JWT; proves who the user is (sub, email, name, groups)
• Access Token — proves what the app is allowed to do; sent to APIs
• Refresh Token — long-lived; used to get new access tokens silently

Discovery

• Every OIDC provider exposes /.well-known/openid-configuration
• Contains token endpoint, auth endpoint, JWKS URI
• Keycloak: /realms/persona/.well-known/openid-configuration
• Claims: sub, email, name, groups, roles

OAuth 2.0

OAuth 2.0 — Authorization Framework

OAuth 2.0 is an authorization framework — it answers “what is this application allowed to do?” not “who is this user?”. It defines how a client application can obtain limited access to a resource on behalf of a user, without ever seeing the user’s password. OIDC is built on top of OAuth 2.0 and adds the identity layer.

Grant Types

Grant Type	When to Use	Who Gets the Token
Authorization Code	Web apps, mobile apps — user present	Backend server (after code exchange)
Client Credentials	Machine-to-machine (no user)	The service itself
Device Flow	CLI tools, TV apps, limited input	Device polls until user approves on phone
Implicit (deprecated)	Old SPAs — avoid; use Auth Code + PKCE	Browser (unsafe)

SAML 2.0

SAML 2.0 — Security Assertion Markup Language

SAML is an XML-based open standard for exchanging authentication and authorisation data between an Identity Provider and a Service Provider. Predating OIDC by a decade, it is the dominant protocol in enterprise on-premise environments (Salesforce, Workday, legacy SaaS). Keycloak supports SAML alongside OIDC.

SAML vs OIDC

Aspect	SAML 2.0	OIDC
Format	XML assertions	JSON / JWT
Transport	HTTP POST / redirect (form)	HTTP redirect + JSON API
Best for	Enterprise on-prem, legacy SaaS	APIs, mobile, modern web apps
Complexity	High — XML signatures, metadata exchange	Lower — JWT, discovery endpoint
Mobile support	Poor (POST binding needs browser)	Excellent

Keycloak

Keycloak — Unified Identity Hub

Keycloak is an open-source Identity and Access Management server. A single Keycloak instance can serve multiple Realms (isolated identity domains), each with its own users, clients (applications), roles, and groups. It speaks OIDC, OAuth 2.0, and SAML simultaneously, and federates from LDAP or Active Directory. For Persona, one Keycloak login unlocks every internal tool.

Persona Setup Plan

• Create persona realm (isolated from other projects)
• Add OpenLDAP federation (user source of truth)
• Register OIDC clients: ArgoCD, Grafana, Temporal, MinIO
• Wire Traefik ForwardAuth for apps without native OIDC (Qdrant)
• Groups: admins, developers, viewers

Key Concepts

• Realm — isolated domain; own users, clients, settings
• Client — an application registered to use Keycloak OIDC
• Client Secret — shared secret for backend code exchange
• Role — permission unit; assigned to users or groups
• Federation — Keycloak reads users from external LDAP