Modern authentication protocols

To understand why we need modern authentication protocols, let's go back in time to see how things were. Years ago, a typical organization needed only on-premises domain controllers (running Active Directory) to provide authentication for their business applications. This was a time when the users, the servers running the business applications, and the domain controllers lived happily within the same network perimeter. Authentication occurred using either Kerberos or NTLM, which are both protocols designed to authenticate scenarios where both the application and the identity provider lived on the same network. You could tell this from the number of network ports that needed to be opened for Kerberos to work (Figure 2.4).

Times have changed since then! The majority of business applications that organizations use are now cloud-hosted (living in someone else's data centers). It is not practical to expose all the ports that Kerberos alone needs...