How to Start Your IAM Journey Right — In Three Steps
Judith Kahrer
· 3 min readOn this page
You should never overlook security when developing a new application or when managing existing ones. It is crucial to ensure that all sensitive data is protected and access is secured. In other words, you need to design a solution that allows you to:
Avoid data leaks and cyber attacks
Meet compliance and regulatory requirements
Integrate security features in a simple and scalable manner
Below, I will provide advice on what to consider when starting your identity and access management (IAM) journey.
1. Choose a Standards-Based Solution
Just like with physical buildings, developing software architecture requires a good foundation. While your app is small and use cases might be limited, to begin with, ad hoc solutions and patches can seem simple and cost-effective. However, this will quickly change as the number of APIs, apps, and websites increases. To ensure long-term success and future growth, I recommend using established security standards like OAuth 2.0 and OpenID Connect, which can be handled by an identity server.
2. Use an Identity Server
An identity server allows you to manage identities, store credentials, and capture user consent when needed. An identity server that supports OAuth 2.0 or OpenID Connect, like the Curity Identity Server, enables you to secure your APIs with tokens.
When your user logs into your app, the identity server issues an identity token to the app, followed by the access token that controls which data can be accessed and which operations the application can perform on behalf of that user. The access tokens are used when calling APIs to ensure API access (and related data) is delegated by an authenticated user. This also allows you to implement proper authorization controls.
Place the identity server behind a reverse proxy. The reverse proxy serves as an additional layer of security. It prevents the identity server, which has access to sensitive data sources, from being directly exposed to the internet.
3. Remember the User Login Experience
Returning to the architectural metaphor, think of the login user experience as an entrance to your well-planned, safe, high-tech building — it should be as thought-through as possible. Users should have easy access to digital services with minimal friction. Authentication that is too intrusive, slow, or complex risks frustrating users and losing customers.
Therefore, your IAM system needs to take fine control over authentication flows and provide a consistent, secure, and smooth login process.
How to Start?
When it comes to security, you should rely on the work of experts. You may think you need to invest heavily in an extensive system, but that is not necessarily the case. For example, Curity offers the Community Edition of the Curity Identity Server, which has helped many organizations and individuals speed up their security implementations. The Community Edition of the Curity Identity Server is a free, complete OAuth server, perfect for small organizations or individuals just starting out.
You can download the Community Edition directly from our website. And I also recommend you check out these resources to help you get started:
Related resources
Frequently Asked Questions
What's the difference between an identity token and an access token?
An identity token confirms who the user is (used by the application to know who's logged in), while an access token authorizes what the application can do on the user's behalf when calling APIs — they serve distinct purposes even though both are issued during the same login flow.
What's the risk of exposing an identity server directly to the internet without a reverse proxy?
Without a reverse proxy, the identity server becomes a more direct target for attacks, since it typically has access to sensitive credential and identity data — a reverse proxy adds a buffer layer that can filter, rate-limit, and monitor traffic before it reaches that sensitive system.
How long does it typically take a small organization to implement a standards-based IAM solution from scratch?
This varies widely based on existing infrastructure and team experience, but using a pre-built identity server (rather than building OAuth/OIDC support from scratch) significantly shortens implementation time, often to weeks rather than months.
Can switching from an ad hoc security solution to a standards-based identity server be done without disrupting existing users?
It's possible with careful planning — this usually involves a phased migration where existing user sessions and credentials are gradually transitioned to the new system, rather than forcing all users to re-register at once.