Well lets talk about your average 'bigcorp'. You've got laptops you need to log into, you've got network shares you need to log into, you've got internal web ap

Well lets talk about your average 'bigcorp'. You've got laptops you need to log into, you've got network shares you need to log into, you've got internal web applications you need to log into, you've got external saas bullshit you need to log into, you have some cloud accounts you need to access... You need to manage this for thousands of people, probably 10s of thousands of people. You don't want your average user to have a great many usernames and passwords, maybe two or three at most to manage. You also probably don't want to have them share those credentials.. though without 'one big system' you can't really prevent that. You also probably want some kind of system with 2factor support through a few different methods, rolling code, sms, yubikey, etc. LDAP ain't it. From where I set Oauth seems to be the current solution with the least number of downsides. It's complicated for sure, the flows are easy to fuck up, but I haven't seen a better solution. Maybe Passkey is it, i keep meaning to read the rundown but I just haven't found the time... and also it's realativly new enough that support and open source solutions might be a little sparse...