Two open-source projects for the identity community: Awesome Identity and IAM Interview Questions
We published two community projects on GitHub. Awesome Identity is a curated, vendor-neutral list of more than 650 identity resources, from standards and open-source libraries to a vendor directory. IAM Interview Questions is a bank of over 240 questions with notes on what a strong answer shows. Both are free, openly licensed, and open to pull requests.
Start with Identity now has two open-source projects on GitHub, under github.com/Start-With-Identity. Awesome Identity is a curated, vendor-neutral list of identity and access management resources. IAM Interview Questions is a question bank for people preparing for identity roles. Both are free, both are openly licensed, and both get better when practitioners send a pull request.
We put them on GitHub instead of on this site so anyone can fix a mistake or add what is missing, with the review in public and the credit in the commit history.
Awesome Identity
Identity covers a lot of ground. Specs live at the IETF, the OpenID Foundation, the W3C and the FIDO Alliance. Libraries are spread across every language. Vendor categories keep splitting. Awesome Identity puts it in one place, organized the way practitioners look for things:
- Standards and specifications: OAuth and OpenID Connect, tokens and keys, federation and provisioning, passkeys, shared signals, digital credentials and wallets, and high-assurance profiles such as FAPI.
- Guidance and reference: government and regulatory guidance, glossaries and reference models.
- Open source: identity providers and auth servers, libraries for JavaScript and TypeScript, Python, Go, Java, .NET, Rust, PHP, Ruby and mobile, plus passkey libraries, authorization engines, provisioning, secrets and workload identity, privileged access tooling, decentralized identity tooling and testing tools.
- Security research: assessment tooling for authorized testing, detection content, hardening guides, breach write-ups and threat reports.
- Vendor directory: identity vendors by category, alphabetical, one neutral sentence each.
- Learning and community: books, courses, blogs, podcasts, talks, learning paths, careers, conferences, organizations and people to follow.
As of launch the main list has more than 650 entries. Each one carries a tag that tells you what you are clicking: open source, free, freemium, commercial, a published standard, government guidance, or archived.
How it stays neutral
The rules are the same ones this site follows. Inclusion is not endorsement. No entry is paid for. There are no featured slots, no rankings and no affiliate links. Vendors are listed alphabetically with a one-line factual description, and vendors who submit themselves follow the same rules as everyone else and disclose the affiliation in the pull request.
Ranking and comparison stay here, where they come with a published methodology. The list is a directory.
How it stays healthy
Entries live in small YAML files, and the README is generated from them. Contributors edit one file, and automated checks catch dead links, duplicates, ordering and promotional wording before a maintainer reviews. A scheduled link check flags anything that has gone stale.
If you mainly want essays and concepts, Awesome IAM is a long-standing reading list on identity and access control, and Awesome Identity links to it. The two are meant to complement each other.
The list is released under CC0-1.0, so you can reuse it however you like.
IAM Interview Questions
The interview question bank has over 240 questions across 17 topic files: fundamentals, OAuth and OpenID Connect, SAML and federation, tokens and sessions, authorization and governance, specialties such as PAM, CIAM and machine identity, architecture and security, and interview craft. Each question is tagged by level, from junior to senior and architect, and comes with notes on what a strong answer demonstrates. The goal is to learn the reasoning, not memorize a definition.
It pairs with the IAM interview questions guide and the rest of the career hub on this site. The repository is licensed CC BY 4.0.
How to contribute
- Add a resource to Awesome Identity. Read the contribution guidelines, add one entry to the right YAML file, and open a pull request. If you would rather not use git, the repository has an issue form for suggesting a resource.
- Report a problem. Dead links, wrong descriptions and outdated vendor names can be reported through the repository's issue templates.
- Improve the question bank. Add a question, sharpen an answer, fix an error, or translate a section.
- Star and share. Stars help other practitioners find the projects.
Every contributor is credited. If you want to do more, the community page lists the volunteer roles that run the rest of Start with Identity.
Related on Start with Identity
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BlogWhy We're Building a Daily Identity Blog (And What You'll Get From It)
The identity industry moves faster than any single team can track. This blog is our attempt to keep practitioners current with quality, vendor-neutral writing,
- ArticleTop 10 Open-Source IAM Solutions
Explore the best open-source identity and access management solutions in 2026, from Keycloak and Authentik to Zitadel and Ory, with deployment guidance and feat
- BlogKeycloak password reset flaw let anyone skip the email token and take over any account
CVE-2026-18963 is improper state validation in Keycloak's reset-credentials flow. A crafted request jumped the authentication session straight to the password-u
- CVEKeycloak reset-credentials flow skips the email token, full account takeover
Improper state validation in Keycloak's reset-credentials authentication flow let an unauthenticated attacker jump straight to the password-update step, no emai
- ArticleOpen Source Authorization Service: 7 Tools Compared
The best open-source authorization tools in 2026, from OpenFGA and SpiceDB to Oso, Cerbos, Open Policy Agent, Ory Keto, and Casbin, with the policy models behin