Why Identity Feels Different

If you've spent most of your career building web applications, learning Identity and Access Management (IAM) can feel surprisingly different.

You might be an excellent Java developer. Or Python. Or Go. You may have built distributed systems, designed REST APIs, or deployed applications to Kubernetes. None of that automatically prepares you for Identity.

That's because IAM is one of the few areas in software where understanding the theory is just as important as writing the code.

In many software projects, if a deadline is slipping, you can often add more engineers to the team. They may need a few days to understand the codebase, but they'll soon become productive.

Identity rarely works that way.

Adding five experienced backend engineers to an OAuth or SAML integration doesn't mean the work will finish five times faster. Everyone first needs to understand the underlying protocols, the terminology, and the security model. Until those concepts become familiar, even experienced engineers can find themselves reading specifications, tracing redirects, and wondering why there are three different tokens.

One of the reasons is that Identity is built on standards.

That's both its greatest strength and one of its biggest challenges.

The strength is obvious. Because protocols such as OAuth, OpenID Connect, SAML and SCIM are standardized, vendors can interoperate. Libraries exist in almost every programming language. Frameworks know how to speak the protocols. Once you understand the standards, you're working with concepts that apply almost everywhere.

The challenge is that standards leave very little room for interpretation.

A REST API can have different URL structures. Two microservices can expose completely different JSON formats and still be perfectly valid.

OAuth doesn't work like that.

A missing parameter, an incorrect redirect URI, an audience mismatch, or a token that's validated incorrectly isn't just a stylistic difference—it usually means the integration fails.

That's why experienced identity engineers spend so much time understanding the protocols before they start writing code.

The good news is that once the mental model clicks, the protocols stop feeling mysterious. You'll begin to recognize the same patterns across OAuth, OpenID Connect, SAML, SCIM, and many other identity standards.

This series is about building that mental model, one concept at a time.