身份管理的演进

How does a site know who you are? Identity management covers verifying you (authentication) and your permissions (authorization). Let's trace how it evolved.

Early on, every system kept its own accounts. With local authentication, ten apps meant ten separate username-password pairs to juggle.

Local accounts didn't scale: password fatigue, risky reuse, and heavy admin cost across many systems. Identity needed to be centralized.

The fix was centralized directories — LDAP, and Microsoft's Active Directory — letting one account unlock many internal apps and easing management.

HTTP is stateless, so the web needed memory. Cookies store a session ID in your browser, linking you to server-side state so you stay logged in.

Single Sign-On (SSO) lets you log in once and reach many apps. SAML, an XML standard, exchanges auth data between an identity provider and service provider to make it work.

Mobile and cloud needed apps to access each other's data safely. OAuth delegates access without sharing passwords; OIDC adds an identity layer on top.

Decentralized Identity (DID) flips the model: you own and manage your identifiers, often anchored on a blockchain, instead of trusting one central provider.

The frontier is going passwordless — magic links, biometrics, and FIDO security keys — removing the weakest link: human-chosen passwords.

Which of the following advancements marked significant steps in the evolution of identity management?

Recap: identity went from local logins to directories, then SSO with SAML, then OAuth and OIDC — with decentralized and passwordless methods shaping what's next.