SAML, OIDC, SCIM and Shared Signals: the protocols that join an IAM stack

SAML and OpenID Connect: sign-in

Both let an application trust an identity provider instead of keeping its own passwords. SAML is common in older enterprise applications; OpenID Connect builds on OAuth 2.0 and is common in newer and mobile applications. Google lists thousands of pre-integrated SAML 2.0 and OIDC apps, and Ping lists SAML, OIDC and OAuth 2.0 in its Essential tier. An application that supports neither cannot join single sign-on.

SCIM: accounts

SCIM, the System for Cross-domain Identity Management, has its protocol defined in RFC 7644 (September 2015), which describes it as "an HTTP-based protocol that makes managing identities in multi-domain scenarios easier". With SCIM, a provider can create, update and deactivate accounts in an application. Without it, lifecycle changes need another connector, a script or a person. Microsoft documents provisioning by SCIM 2.0 and also by LDAP, SQL, REST, SOAP, PowerShell and ECMA connectors for applications that lack it.

LDAP, Kerberos and RADIUS: older systems

Older systems and networks often expect these. Ping's Essential tier lists LDAP, Kerberos and a RADIUS gateway, and JumpCloud offers cloud LDAP and RADIUS. Active Directory relies on Kerberos, which is why attacks such as Kerberoasting and Pass-the-Ticket appear in the detection products Silverfort describes.

Shared Signals, CAEP and RISC: security events

Sign-in happens once; risk changes during a session. The OpenID Foundation's Shared Signals Working Group defines a framework for tools to send each other events. CAEP covers session events such as Session Revoked, Token Claims Change, Credential Change, Assurance Level Change and Device Compliance Change. RISC covers account events such as Account Purged, Disabled or Enabled and Identifier Changed or Recycled. CAEP and RISC were approved as Final on 2 September 2025. Okta lists Shared Signals with CrowdStrike, Zscaler, Palo Alto Networks and Jamf.

What do none of them do?

No protocol finds an application that was never connected, or a local account created inside an application. That is why application coverage is a separate job.

How do you check an application?

For each important application, record: SAML or OIDC for sign-in; SCIM for provisioning; whether it keeps local accounts; and whether it can send or receive security events. The answers place it in the stack.