IAM learning resources
A curated, vendor-neutral library of the best identity and access management resources on the internet, organized for learning. Standards and RFCs, government and OWASP guidance, academic research, industry threat reports, books, blogs, and conference talks. Every link is verified and points to the original source.
New to the field? Follow the guided learning path or begin with our fundamentals, then use this page to go to the primary sources.
Standards & specs
The primary sources. Read these to understand the protocols exactly as defined.
The foundational OAuth 2.0 specification defining roles, grant types, and authorization flows every practitioner must understand.
Defines how bearer tokens are presented in HTTP requests to access protected resources, with handling and error semantics.
Specifies the compact, URL-safe token format used everywhere in modern identity to represent signed claims between parties.
Explains the authorization code interception attack and the PKCE mitigation now mandatory for secure public clients.
Best current practice for OAuth in mobile and desktop apps, covering system browsers and redirect handling.
Defines the device flow that enables authorization on input-constrained devices like TVs and CLI tools.
The current consolidated OAuth threat model and security guidance, essential for building hardened deployments.
Defines the standard REST protocol for provisioning and managing user identities across domains and applications.
The authoritative identity layer over OAuth 2.0 defining ID tokens, UserInfo, and authentication flows for federated login.
The browser API standard behind passkeys and phishing-resistant passwordless authentication with public key cryptography.
The vendor-neutral hub linking every OAuth specification and extension, ideal for navigating the standards landscape.
Government & guidance
Authoritative, vendor-neutral guidance on authentication, zero trust, and identity assurance.
The current overarching federal framework defining identity proofing, authentication, and federation assurance levels.
Defines authentication assurance levels and detailed requirements for authenticators, MFA, and phishing resistance.
The foundational reference defining zero trust concepts, components, and deployment models for identity-centric security.
Maps a practical maturity path across pillars, with identity as the first and central capability area.
A testable checklist of authentication, session, and access control requirements for verifying application security.
Concise, practical guidance on implementing secure login, credential storage, and account recovery.
Covers least privilege, deny by default, and ABAC or ReBAC models for sound access control design.
Explains MFA factor types, tradeoffs, and implementation pitfalls in clear practitioner terms.
Vendor-neutral UK guidance on choosing and deploying strong MFA for corporate services.
Surveys remote identity verification methods, attacks, and good practices across the EU regulatory landscape.
Research & academic
Peer-reviewed papers and surveys for a deeper, formal understanding.
Formal web-model analysis of OAuth 2.0 that uncovers four real attacks and proves fixed flows secure.
First rigorous formal analysis of OpenID Connect, deriving necessary and sufficient security guidelines for implementers.
PRISMA review of a decade of zero trust research, with a taxonomy of applications, technologies, and adoption barriers.
Surveys W3C DIDs and verifiable credentials, their implementations, and use cases across cloud, edge, and IoT.
Traces digital identity evolution to SSI, covering building blocks, platforms, regulations, and open research challenges.
Compares device-bound and synced FIDO2 passkeys on usability and security, showing where syncing concentrates risk.
Systematizes web authentication and recovery for end-to-end encrypted services and surveys real passkey deployment.
Explains ABAC and shows how to express and evaluate attribute policies efficiently using a graph database.
Shows how SPIFFE replaces static secrets with runtime workload identity for non-human actors in zero trust pipelines.
Industry & threat reports
Recurring reports that show how identity is actually attacked and defended at scale.
Data-driven analysis of breach patterns showing how stolen credentials, phishing, and human error drive identity attacks.
Global threat telemetry covering nation-state and criminal identity attacks, MFA bypass, and token theft at scale.
Incident-response frontline data on attacker dwell time, initial access, and identity compromise during real intrusions.
Tracks adversary tradecraft including identity-based intrusions, breakout speed, and attacks spanning identity and cloud.
Network-scale view of how identity exploitation, token theft, and MFA bypass replace brute force as attack methods.
Analyzes billions of authentications to reveal MFA adoption, device trust, and access-security trends across organizations.
Uses Auth0 telemetry to show signup-attack rates, credential reuse, and how identity security shapes customer trust.
Analyzes workforce authentication data showing rapid growth of phishing-resistant and passwordless methods over legacy MFA.
Consumer survey tracking password habits, biometric adoption, and momentum toward phishing-resistant passwordless authentication worldwide.
Courses
Structured, hands-on learning, mostly free and vendor-neutral.
Free interactive labs covering authentication factors, brute-force defenses, and logic flaws that bypass login systems.
Free hands-on labs teaching how OAuth flows work and how common implementation flaws are exploited and prevented.
Free two-hour video course introducing OAuth 2.0 concepts, token flows, and practical implementation for newcomers.
Free path covering identity types, authentication, access management, and identity governance concepts.
Vendor-neutral course on authentication architectures, SSO, MFA, federation, and passwordless methods.
Authoritative standards-body explainer walking through the OpenID Connect flow, tokens, and the relying-party and provider roles.
Books, courses & blogs
Longer-form learning and the practitioners worth following.
Hands-on guide to building OAuth 2.0 clients, servers, and tokens by spec editors Justin Richer and Antonio Sanso.
Neil Madden teaches securing REST APIs with OAuth2, tokens, mTLS, and modern authentication and authorization patterns.
Free online book walking through OAuth 2.0 flows for server-side, mobile, and single-page applications.
Official hub explaining OpenID Connect, JWTs, federation, and certified implementations.
Vendor-neutral curated articles covering IAM fundamentals, federation, access control, and identity governance for practitioners.
OAuth standards editor writes on emerging identity specs, authentication patterns, and protocol design.
Technical tutorials on authentication, authorization, OAuth, and secure application development across many frameworks.
Developer articles on identity, OAuth, OIDC, passkeys, and token management with practical code examples.
Developer-focused posts on authentication, MFA, single sign-on, and the Microsoft identity platform.
A thesis on why legacy CIAM is failing and what modern, developer-first customer identity replaces it with.
Data-driven roundup of where customer identity is heading, mined from real vendor release notes.
How AI agents and AI-generated code break traditional identity assumptions and what non-human identity now requires.
A practical, end-to-end walkthrough of designing and implementing authentication in modern apps.
A technical tour of the common implementation flaws across the major federation and token standards.
A hands-on architectural blueprint for implementing zero trust, with identity at the center.
An explainer on continuous, event-driven access control and the OpenID CAEP shared-signals standard.
A broad reference glossary of digital identity and IAM terminology for newcomers.
A career guide to entering identity and access management, an often-overlooked security specialty.
A clear side-by-side of passkeys and passwords covering security, usability, and the migration path.
A research pillar mapping the emerging tooling layers for securing AI systems and agents.
When and how to adopt open-source customer identity, with trade-offs against managed platforms.
Vendor-neutral CIAM comparison portal ranking 48 customer identity platforms on a 30-plus capability matrix across 18 verticals.
Video & talks
Clear explainers and conference talks when you would rather watch than read.
Clear plain-language walkthrough of why OAuth and OpenID Connect exist and how their flows and tokens work.
OAuth co-author Aaron Parecki discusses real-world OAuth design decisions, common pitfalls, and best practices.
A deeper dive into advanced OAuth topics like PKCE, security hardening, and modern flow recommendations.
Comprehensive session covering OAuth and OpenID Connect fundamentals from a standards expert's perspective.
Official short explainer on why passkeys replace passwords and how phishing-resistant passwordless sign-in works.
Technical primer detailing the FIDO and WebAuthn mechanics behind passkeys and synced credentials.
Developer-focused channel with screencasts and talks on OAuth, OIDC, SSO, and identity protocol integration.
Vendor-neutral security conference with research talks on authentication, authorization, and zero trust architecture.
Podcasts
Identity and security shows to learn from on the move.
For identity-specific shows with publisher, vendor ties, and status, see the identity podcast directory and its episode learning paths.
Weekly deep dives into IAM, IGA, PAM, and identity security from two veteran practitioners.
Independent analyst commentary on identity security vendors, funding, mergers, and market trends.
Practical guidance on defending hybrid Active Directory and identity environments against attacks.
Long-running weekly cybersecurity news show with frequent coverage of identity and authentication threats.
Weekly explainer-style show breaking down authentication, encryption, and personal security fundamentals.
Narrative stories of hacks and breaches that vividly illustrate why identity controls matter.
Company & investor reports
Primary filings for understanding the identity market and its economics.
Read a pure-play identity vendor's risk factors, revenue model, and competition to understand IAM economics firsthand.
Investor presentations and earnings give an accessible overview of the leading independent identity company's strategy and metrics.
Historical annual reports explain privileged access management economics before Palo Alto Networks acquired CyberArk in 2026.
Filings from the re-listed identity governance leader explain the IGA segment and the economics behind its relisting.
Reveals how a platform incumbent reports security and identity within broader cloud segments, framing competitive pressure.
Details a network-security entrant expanding into zero trust and identity, showing how adjacencies reshape the IAM market.
Learning IAM: frequently asked questions
- What are the best resources to learn identity and access management?
- Start with the primary standards (OAuth 2.0 RFC 6749, OpenID Connect Core, and WebAuthn), pair them with NIST SP 800-63 and OWASP cheat sheets, then go deeper with academic surveys, industry reports like the Verizon DBIR, and books such as OAuth 2 in Action. This page curates all of them.
- Where can I read the official OAuth and OpenID Connect specifications?
- The OAuth 2.0 specifications are published by the IETF on datatracker.ietf.org (RFC 6749 and its companions), and OpenID Connect is published by the OpenID Foundation at openid.net. Both are linked in the standards section of this page.
- Are these IAM resources free?
- Most are free, including all standards, NIST and OWASP guidance, academic papers, government guidance, blogs, and conference talks. A few books are paid, and some industry reports require registration. Each link goes to the original source.
- How is this resource list curated?
- We select authoritative, vendor-neutral, and genuinely educational sources, verify that each link is live, and add a short note on the learning value. Links point to external sites and are not endorsements. Suggest additions through our contact page.