---
title: Supported standards
description: IG implements the following RFCs, Internet-Drafts, and standards:
component: pinggateway
version: 7.2
page_id: pinggateway:reference:Standards
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/Standards.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2022-04-12T12:16:42Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/Standards.html
---

# Supported standards

IG implements the following RFCs, Internet-Drafts, and standards:

* [OAuth 2.0](https://oauth.net/2/)

  [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749)

  [RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://www.rfc-editor.org/rfc/rfc6750)

  [RFC 7515: JSON Web Signature (JWS)](https://www.rfc-editor.org/rfc/rfc7515)

  [RFC 7516: JSON Web Encryption (JWE)](https://www.rfc-editor.org/rfc/rfc7516)

  [RFC 7517: JSON Web Key (JWK)](https://www.rfc-editor.org/rfc/rfc7517)

  [RFC 7518: JSON Web Algorithms (JWA)](https://www.rfc-editor.org/rfc/rfc7518)

  [RFC 7519: JSON Web Token (JWT)](https://www.rfc-editor.org/rfc/rfc7519)

  [RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://www.rfc-editor.org/rfc/rfc7523)

  [RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol](https://www.rfc-editor.org/rfc/rfc7591)

  [RFC 7662: OAuth 2.0 Token Introspection](https://www.rfc-editor.org/rfc/rfc7662)

  [RFC 7800: Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)](https://www.rfc-editor.org/rfc/rfc7800)

  [RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens](https://www.rfc-editor.org/info/rfc8705)

- [OpenID Connect 1.0](http://openid.net/connect/)

  IG can be configured to play the role of OpenID Connect relying party. The OpenID Connect specifications depend on OAuth 2.0, JSON Web Token, Simple Web Discovery and related specifications. The following specifications make up OpenID Connect 1.0.

  * [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html) defines core OpenID Connect 1.0 features.

    |   |                                                                                                                                                                      |
    | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    |   | In section 5.6 of the specification, IG supports *Normal Claims*. The optional *Aggregated Claims* and *Distributed Claims* representations are not supported by IG. |

  * [OpenID Connect Discovery 1.0](https://openid.net/specs/openid-connect-discovery-1_0.html) defines how clients can dynamically discover information about OpenID Connect providers.

  * [OpenID Connect Dynamic Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html) defines how clients can dynamically register with OpenID Connect providers.

  * [OAuth 2.0 Multiple Response Type Encoding Practices](https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html) defines additional OAuth 2.0 response types used in OpenID Connect.

* User-Managed Access (UMA) 2.0

  [User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization](https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-08.html)

  [Federated Authorization for User-Managed Access (UMA) 2.0](https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-08.html)

- [Representational State Transfer (REST)](http://en.wikipedia.org/wiki/Representational_state_transfer)

  Style of software architecture for web-based, distributed systems. IG's APIs are RESTful APIs.

* [Security Assertion Markup Language (SAML)](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language)

  Standard, XML-based framework for implementing a SAML service provider. IG supports multiple versions of SAML including 2.0, 1.1, and 1.0.

  Specifications are available from the [OASIS standards page](https://www.oasis-open.org/standards).

- Other Standards

  [RFC 4627: The application/json Media Type for JavaScript Object Notation (JSON)](https://www.rfc-editor.org/rfc/rfc4627). JSON text is encoded with Unicode; IG reads and stores JSON as Unicode.

  [RFC 2616: Hypertext Transfer Protocol — HTTP/1.1](https://www.rfc-editor.org/rfc/rfc2616).

  [RFC 2617: HTTP Authentication: Basic and Digest Access Authentication](https://www.rfc-editor.org/rfc/rfc2617), supported as an authentication module.

  [RFC 4510: Lightweight Directory Access Protocol (LDAP)](https://www.rfc-editor.org/rfc/rfc4510), for authentication modules and when accessing data stores.

  [RFC 5280: Internet X.509 Public Key Infrastructure Certificate](https://www.rfc-editor.org/rfc/rfc5280), supported for certificate-based authentication.

  [RFC 5785: Defining Well-Known Uniform Resource Identifiers (URIs)](https://www.rfc-editor.org/rfc/rfc5785).

  [RFC 6265: HTTP State Management Mechanism](https://www.rfc-editor.org/rfc/rfc6265) regarding HTTP Cookies and `Set-Cookie` header fields.