96 profiles

Experts directory

Identity is a field with unusually visible authorship. The protocols have named editors, the platforms have founders who wrote the first version themselves, and the profession has an association because a handful of people decided to build one. This directory is for those people: protocol and standards authors, founders who built an identity platform from scratch, the maintainers of the open-source identity software much of the internet runs on, the academics whose papers became standard practice, the researchers who break these systems in public so they get fixed, the policy people who write the rules and the national schemes, the practitioners who run all of it, community builders, and the architects whose framing the rest of the field still argues inside.

Specifications read differently once you know who wrote them and what problem they were solving, so each profile links the standards, platforms, and guides that person's work produced. Profiles are built from public information only and link to each person's own work. We do not speak for anyone listed here, and inclusion is not an endorsement in either direction. For practitioners talking about systems they run today, see the interviews; for the people who build this site, the contributors page. Someone missing, or something wrong? Tell us below.

Protocol & Standards Authors

25 people

The people who wrote the specifications identity actually runs on: OAuth, OpenID Connect, SAML, SCIM, WebAuthn, and the credential formats replacing them.

Aaron Parecki

Director of Identity Standards · Okta

Maintainer of oauth.net and author of OAuth 2.0 Simplified

Annabelle Backman

Co-chair, OpenID Shared Signals working group · AWS

Editor of RFC 8935 and RFC 8936, push and poll delivery for Security Event Tokens

Atul Tulshibagwale

Inventor of CAEP, co-chair of the Shared Signals working group · CrowdStrike

Invented the Continuous Access Evaluation Protocol (CAEP) while at Google

Brian Campbell

Distinguished Engineer · Ping Identity

Co-author of multiple OAuth working group RFCs

Christopher Allen

Co-author of TLS 1.0 and the W3C DID specification · Blockchain Commons

Co-author of the IETF TLS 1.0 specification

Daniel Fett

Editor, SD-JWT and SD-JWT VC · Authlete

Editor of the SD-JWT and SD-JWT VC specifications

Dick Hardt

Editor, OAuth 2.0 (RFC 6749) · Hellō

Editor of RFC 6749, The OAuth 2.0 Authorization Framework

Drummond Reed

Co-editor, W3C Decentralized Identifiers 1.0 · Gen Digital

Co-editor of the W3C Decentralized Identifiers (DID) 1.0 specification

Emil Lundberg

WebAuthn specification editor and software engineer · Yubico

Editor of the W3C Web Authentication specification

Eve Maler

Identity Architect and Standards Contributor · Venn Factory (Independent)

Co-inventor of XML (W3C)

Hannes Tschofenig

IETF working group chair and RFC author · Siemens

Co-chaired the IETF OAuth working group

John Bradley

Senior Standards Architect · Yubico

Co-author of WebAuthn and FIDO2 specifications

Justin Richer

Independent Consultant · Bespoke Engineering

Co-author of 'OAuth 2 in Action' (Manning, 2017)

Kristina Yasuda

Editor, OpenID for Verifiable Credentials · SPRIND

Editor of OpenID4VP and OpenID4VCI, the protocols for presenting and issuing digital credentials

Manu Sporny

Founder and CEO, Digital Bazaar · Digital Bazaar

Co-creator of the W3C Verifiable Credentials and Decentralized Identifiers work

Mike Jones

Identity Standards Architect (former) · Self-Employed Consultant

Co-author and editor of OAuth 2.0 (RFC 6749) supporting documents

Nat Sakimura

Chairman · OpenID Foundation

Co-author of OpenID Connect Core 1.0

Pamela Dingle

Director of Identity Standards · Microsoft

OpenID Foundation board member

Phil Hunt

Editor, SCIM Protocol (RFC 7644) · Independent Identity

Editor of RFC 7644, the SCIM protocol

Samuel M. Smith

Inventor of KERI and author of the ACDC specification · ProSapien

Invented KERI, Key Event Receipt Infrastructure, a ledger-less approach to decentralized identifiers

Scott Cantor

Technical editor, SAML 2.0; architect, Shibboleth · The Ohio State University / Shibboleth Consortium

Did most of the technical editing of the SAML 2.0 specifications at OASIS

Tim Cappalli

Standards Architect · Okta

Editor of the W3C Web Authentication and Digital Credentials API specifications

Tobias Looker

CTO, MATTR; editor of OpenID4VCI and BBS Signatures · MATTR

Editor of OpenID for Verifiable Credential Issuance

Torsten Lodderstedt

Editor, OAuth 2.0 Security Best Current Practice · SPRIND

Editor of the OAuth 2.0 Security Best Current Practice and RFC 6819, the OAuth threat model

Vittorio Bertocci

Identity Advocate (in memoriam) · Auth0 / Okta (former)

Long-running 'Identity, Unlocked' podcast

Founders & Builders

16 people

People who built an identity platform from nothing, and in several cases created the product category it now sits in.

Andre Durand

Founder and CEO · Ping Identity

Founded Ping Identity in 2002

Colin Sidoti

Co-founder and CEO, Clerk · Clerk

Co-founded Clerk in 2019 with Braden Sidoti

Deepak Gupta

Founder, Start with Identity · GrackerAI

Founded the CIAM platform LoginRadius in 2013 and built it from scratch as board member, CTO, and CISO

Eugenio Pace

Co-Founder, Auth0 (former) · Independent

Co-founded Auth0 in 2013

Ev Kontsevoy

Co-founder and CEO, Teleport · Teleport

Co-founded Teleport, formerly Gravitational, in 2015

Frederic Kerrest

Co-founder and Vice Chairman, Okta · Okta

Co-founded Okta in 2009 with Todd McKinnon

Mark McClain

Co-founder and CEO, SailPoint · SailPoint

Founded Waveset Technologies in 2000, acquired by Sun Microsystems in 2003

Matias Woloski

Co-Founder, Auth0 (former) · Independent

Co-founded Auth0 in 2013

Michael Grinich

Founder and CEO, WorkOS · WorkOS

Founded WorkOS in 2018 after co-founding Nylas

Reed McGinley-Stempel

Co-founder and CEO, Stytch · Stytch

Co-founded Stytch in 2020 with Julianna Lamb, both from Plaid

Sagi Rodin

Co-founder and CEO, Frontegg · Frontegg

Co-founded Frontegg in 2019 with CTO Aviad Mizrachi

Stina Ehrensvärd

Founder of Yubico, co-inventor of the YubiKey · Yubico

Founded Yubico in 2007 with Jakob Ehrensvärd and co-invented the YubiKey

Todd McKinnon

Co-Founder and CEO · Okta

Co-founded Okta in 2009

Travis Spencer

Founder, Curity · Curity

Founded Curity, an API-focused identity server used in regulated and open-banking deployments

Udi Mokady

Founder, CyberArk · CyberArk (former)

Co-founded CyberArk in 1999 and created the privileged access management category

Wayne Chang

Co-founder and CEO, SpruceID · SpruceID

Co-founded SpruceID, which builds open-source credentialing infrastructure

Open Source Builders

14 people

Maintainers and founders of the open-source identity software a large part of the internet runs on, from identity providers to the libraries underneath them.

Aeneas Rekkas

Co-founder and CTO, Ory · Ory

Designed and implemented Ory Hydra, a certified open-source OAuth 2.0 and OIDC server

Balázs Orbán

Creator of Auth.js, former lead maintainer of NextAuth.js · Independent

Lead maintainer of NextAuth.js, the most widely used authentication library for Next.js

Bill Burke

Co-creator of Keycloak · Red Hat

Co-created Keycloak at Red Hat in 2014 with Stian Thorgersen

Evan Gilman

SPIFFE and SPIRE maintainer, co-author of Zero Trust Networks · Independent

Maintainer of SPIRE, the reference implementation of SPIFFE

Filip Skokan

Maintainer of openid-client, jose, and node-oidc-provider · Okta

Maintains openid-client, jose, and node-oidc-provider, certified OpenID Connect implementations

Florian Forster

Co-founder and CEO, ZITADEL · ZITADEL

Co-founded ZITADEL in 2019 with a team from the Swiss public sector

Jens Langhammer

Creator of authentik, CTO of Authentik Security · Authentik Security

Wrote the first commit of authentik in November 2018 as a personal project

Mike Schwartz

Founder of Gluu, chair of the Janssen Project · Gluu

Founded Gluu in 2009 and built an enterprise IAM platform on open source

Misagh Moayyed

Project lead and chairman, Apereo CAS · Apereo Foundation

Technical lead and chairman of Apereo CAS, in use across higher education worldwide

Rishabh Poddar

Co-founder and CTO, SuperTokens · SuperTokens

Co-founded SuperTokens in 2019 with Advait Ruia

Roland Hedberg

Author of pysaml2 and pyoidc · Umeå University (former)

Wrote pysaml2, the Python SAML 2.0 implementation shipped in many distributions

Stian Thorgersen

Co-founder and Project Lead, Keycloak · Red Hat

Co-founded the Keycloak project at Red Hat in 2013 and leads it

Tim Hinrichs

Co-creator of Open Policy Agent · Styra (former)

Co-created Open Policy Agent with Torin Sandall and Teemu Koponen

Torin Sandall

Co-creator of Open Policy Agent · Styra (former)

Co-created Open Policy Agent and led its open-source engineering

Researchers & Educators

13 people

The academics whose papers became the practice: least privilege, role-based access control, the authentication protocol under Kerberos, and the usability research that ended password complexity rules.

M. Angela Sasse

Professor of Human-Centred Security · Ruhr University Bochum and University College London

Co-authored Users Are Not the Enemy (1999) with Anne Adams

Clifford Neuman

Principal designer of Kerberos · USC Information Sciences Institute

One of the principal designers of Kerberos versions 1 through 4 at MIT Project Athena

Cormac Herley

Principal Researcher · Microsoft Research

Wrote So Long, And No Thanks for the Externalities (2009) on the rational rejection of security advice

Dan Boneh

Professor of Computer Science, Stanford University · Stanford University

Co-author of BLS signatures, Short Signatures from the Weil Pairing

David Ferraiolo

Co-author of the NIST RBAC model · NIST

Co-authored Role-Based Access Controls (1992) with Rick Kuhn

Jerome Saltzer

Professor Emeritus, MIT · MIT (former)

Co-authored The Protection of Information in Computer Systems (1975) with Michael Schroeder

Latanya Sweeney

Professor of the Practice of Government and Technology, Harvard · Harvard University

Developed k-anonymity with Pierangela Samarati

Lorrie Faith Cranor

Director, CyLab; Professor, Carnegie Mellon University · Carnegie Mellon University

Directs CyLab and the CyLab Usable Privacy and Security Laboratory at CMU

Michael D. Schroeder

Co-author of the Needham-Schroeder protocol · Xerox PARC and MIT (former)

Co-authored The Protection of Information in Computer Systems (1975) with Jerome Saltzer

Ravi Sandhu

Professor Emeritus, University of Texas at San Antonio · UTSA Institute for Cyber Security

Author of the RBAC96 family of role-based access control models

Rick Kuhn

Co-author of the NIST RBAC model · NIST

Co-authored Role-Based Access Controls (1992) with David Ferraiolo

Roger Needham

Professor, University of Cambridge (1935 to 2003) · University of Cambridge (former)

Co-authored the Needham-Schroeder authentication protocol (1978)

Ross Anderson

Professor of Security Engineering, University of Cambridge (1956 to 2024) · University of Cambridge (former)

Author of Security Engineering, the standard textbook, across three editions

Identity Security Researchers

5 people

People who break identity systems in public so they can be fixed. Their tools and disclosures are why a long list of defensive controls exist at all.

Andy Robbins

Co-creator of BloodHound · SpecterOps

Co-created BloodHound with Will Schroeder and Rohan Vazarkar, released at DEF CON 24

Benjamin Delpy

Creator of mimikatz · Independent

Created mimikatz in 2011, demonstrating how Windows stored credentials in memory

Dirk-jan Mollema

Entra ID and Active Directory researcher · Outsider Security

Author of ROADtools, mitm6, ldapdomaindump, adidnsdump, krbrelayx, and BloodHound.py

Sean Metcalf

Founder of Trimarc, author of ADSecurity.org · Trimarc

Runs ADSecurity.org, a long-running reference for Active Directory attack and defense

Will Schroeder

Co-creator of BloodHound, AD CS attack research · SpecterOps

Co-created BloodHound with Andy Robbins and Rohan Vazarkar

Policy & Public Identity

7 people

The people who write the rules and build the national systems: NIST’s digital identity guidelines, trust frameworks, and population-scale public identity infrastructure.

Gail Hodges

Executive Director, OpenID Foundation · OpenID Foundation

Executive director of the OpenID Foundation since May 2021

Jeremy Grant

Coordinator, Better Identity Coalition · Venable

Established and led NSTIC, the National Strategy for Trusted Identities in Cyberspace, at NIST

Nandan Nilekani

Founding Chairman, UIDAI (Aadhaar) · Infosys

Founding chairman of UIDAI from 2009 to 2014, with cabinet rank, creating Aadhaar

Nick Mothershaw

Chief Identity Strategist, Open Identity Exchange · Open Identity Exchange

Leads trust framework guidance and interoperability analysis at OIX

Paul Grassi

Lead author, NIST SP 800-63-3 · NIST (former)

Lead author of NIST SP 800-63-3, Digital Identity Guidelines (2017)

Pramod Varma

Chief Architect of Aadhaar and India Stack · EkStep Foundation

Chief architect of Aadhaar, covering more than 1.3 billion people

Ryan Galluzzo

Digital Identity Program Lead · NIST

Digital identity program lead in NIST's Applied Cybersecurity Division

Community Builders

9 people

The organizers, educators, and association founders who turned a scattered set of practitioners into a profession.

Andrew Shikiar

Executive Director and CEO, FIDO Alliance · FIDO Alliance

Leads the FIDO Alliance, the consortium behind FIDO2 and passkeys

Doc Searls

Co-founder, Internet Identity Workshop · ProjectVRM, Harvard Berkman Klein Center

Co-founded the Internet Identity Workshop in 2005 with Kaliya Young and Phil Windley

Heather Flanagan

Standards Editor and Consultant · Spherical Cow Consulting

Editor contributions to the IDPro Body of Knowledge

Ian Glazer

Identity Strategist · Weave Identity (Independent)

Founder of the IDPro professional association

Kaliya Young

Decentralized Identity Advocate and Co-founder, IIW · Independent

Co-founder of the Internet Identity Workshop (IIW)

Phil Windley

Author and Co-founder, IIW · Independent

Co-founder of the Internet Identity Workshop (IIW)

Sarah Cecchetti

Co-founder, IDPro · IDPro

Co-founded IDPro, the professional association for identity practitioners

Troy Hunt

Creator, Have I Been Pwned · Have I Been Pwned

Created Have I Been Pwned in December 2013

Deepak Gupta

Founder, Start with Identity · GrackerAI

Founded the CIAM platform LoginRadius in 2013 and built it from scratch as board member, CTO, and CISO

Practitioners & Operators

3 people

People who run identity systems for a living and teach from it. A growing section, and the one closest to most readers of this site.

Jeff Steadman

Co-host, Identity at the Center · RSM US

Co-hosts Identity at the Center, the weekly IAM practitioner podcast, with Jim McDonald

Jim McDonald

Co-host, Identity at the Center · RSM US

Co-hosts Identity at the Center, the weekly IAM practitioner podcast, with Jeff Steadman

Steve Syfuhs

Principal Software Engineer, Windows Authentication · Microsoft

Works on the team building Windows authentication at Microsoft

Architects & Strategists

5 people

People who design how identity systems fit together at scale, and who set the terms the rest of the field argues in.

Alex Simons

Corporate VP, Identity Product Management · Microsoft

Leads product management for Microsoft Entra identity

Alex Weinert

Identity security leader · Microsoft

Published 'Your Pa$$word doesn't matter', reframing password policy around MFA

George Fletcher

Identity Architect and Standards Contributor · Independent

Long-time contributor to OpenID Connect and OAuth standards

Kim Cameron

Chief Identity Architect, Microsoft (former) · Microsoft (former)

Author of The Laws of Identity (2005)

Nishant Kaushik

Identity Architect and Technologist · Independent

Long-running Talking Identity commentary on the industry

From the people to the protocols

Learn what they built

The specs, the terms, and the implementation patterns these profiles point at.

Add to the directory

Nominate someone, or correct your own profile

This directory is built from public information, which means it is incomplete and will always be. If someone's work belongs here, tell us what they did and where it is documented. Self-nominations are fine: if you wrote a specification, maintain identity software, or published research the field uses, say so.

Corrections take the same route and go to the front of the queue. If you are listed here and want the entry changed, narrowed, or removed, we will do it. You can also email community@startwithidentity.com directly with the same details if you prefer.

We publish checkable claims only, so a nomination without a source will come back to you with a request for one. Inclusion is not an endorsement, and nobody pays to be listed.