Introduction
The OpenID AuthZEN working group has defined a set of interop scenarios. These all are layered around a Todo application as a Policy Enforcement Point.
For the seventh AuthZEN interop event at Gartner IAM Summit in Grapevine (Dec 8 2025), we have added various Identity Providers as Policy Enforcement Points.
What you'll find here
- Interop scenarios for various drafts of the AuthZEN 1.0 authorization API
- Specifications for the payloads and expected responses
- Interoperability results for the vendors that have participated in the interop testing
Interop video
The following video demonstrates the Todo interop scenario and the structure of the demo application.
Architecture
AuthZEN is built around a defense-in-depth approach to IAM:
- coarse-grained authorization can be performed during authentication, with the IdP functioning as a policy enforcement point
- medium-grained authorization can be enforced by API gateways, performing functional authorization at the HTTP route level
- the relying party (in our case, a Todo app) is the final enforcement point, performing fine-grained authorization at the Todo level
Interoperability events
The AuthZEN working group sponsored seven formal interoperability events since June 2024, focusing on various scenarios:
| Scenario | Event | Draft | Endpoints |
|---|---|---|---|
| App Code | Identiverse 2024 | 00 | /evaluation |
| App Code | EIC 2024 | 01 | /evaluation |
| App Code | Authenticate 2024 | 02 | + /evaluations |
| App Code | Gartner IAM US 2024 | 02 | + /evaluations |
| API Gateway | Gartner IAM London 2025 | 02 | + /evaluations |
| Search | Identiverse 2025 | 03 | /search, /.well-known |
| Identity Provider | Gartner IAM US 2025 | 04 | /search |
Results summary
Policy Decision Points
Todo (App Code & API Gateway evaluation / evaluations API) scenarios
Policy Decision Points that participated in the various App Code and API Gateway scenarios.
| Implementation | Todo PEP 00 | Todo PEP 01 | Todo PEP 02 | Gateway PEP 02 |
|---|---|---|---|---|
| Aserto | ✅ Results | ✅ Results | ✅ Results | ✅ Results |
| Axiomatics | ✅ Results | ✅ Results | ✅ Results | ✅ Results |
| Amazon VP | Did not participate | Did not participate | ✅ Results | ✅ Results |
| Cerbos | ✅ Results | ✅ Results | ✅ Results | ✅ Results |
| EmpowerID | Did not participate | ✅ Results | ✅ Results | Did not participate |
| Hexa | ✅ Results | ✅ Results | ✅ Results | ✅ Results |
| Indykite | Did not participate | ✅ Results | ✅ Results | Did not participate |
| Kogito | ✅ Results | ✅ Results | ✅ Results | Did not participate |
| Open Policy Agent | ✅ Results | ✅ Results | ✅ Results | Did not participate |
| OpenFGA | Did not participate | Did not participate | ✅ Results | ✅ Results |
| Permit | ✅ Results | ✅ Results | ✅ Results | Did not participate |
| Ping Authorize | Did not participate | ✅ Results | ✅ Results | ✅ Results |
| PlainID | ✅ Results | ✅ Results | ✅ Results | ✅ Results |
| Real Solid Knowledge | ✅ Results | ✅ Results | ✅ Results | ✅ Results |
| SGNL | ✅ Results | ✅ Results | ✅ Results | ✅ Results |
| Thales | ✅ Results | Did not participate | Did not participate | Did not participate |
| Topaz | ✅ Results | ✅ Results | ✅ Results | ✅ Results |
| WSO2 | Did not participate | Did not participate | ✅ Results | ✅ Results |
| 3Edges | ✅ Results | Replaced by Indykite | Replaced by Indykite | Did not participate |
Search API scenario
Policy Decision Points that participated in the Search scenario.
| Implementation | Search PEP 03 |
|---|---|
| Apache KIE | ✅ Results |
| Axiomatics | ✅ Results |
| Cerbos | ✅ Results |
| EmpowerID | ✅ Results |
| Indykite | ✅ Results |
| PingAuthorize (ID Partners) | ✅ Results |
| PlainID | ✅ Results |
| Topaz | ✅ Results |
| WSO2 | ✅ Results |
Identity Provider interop scenario (search API)
Policy Decision Points that participated in the IdP scenario.
| Implementation | IdP PEP 04 |
|---|---|
| Apache KIE | ✅ Results |
| Axiomatics | ✅ Results |
| Cerbos | ✅ Results |
| EmpowerID | ✅ Results |
| Indykite | ✅ Results |
| Permit | ✅ Results |
| PingAuthorize (ID Partners) | ✅ Results |
| PlainID | ✅ Results |
| SGNL | ✅ Results |
| Topaz | ✅ Results |
| WSO2 | ✅ Results |
API Gateways
API Gateways that participated in the Gateway scenario.
Identity Providers
Identity Providers that support the IdP scenario.
| Implementation | Hosted at |
|---|---|
| Auth0 | https://authzen-idp-demo.eu.auth0.com |
| Curity | https://login-demo.curity.io/ |
| Duende | https://demo-authzen-idsrv.duendesoftware.com |
| EmpowerID | https://idp.authzen-demo.eidlabs.net |
| Gluu / Janssen | https://test-jans5dev.gluu.info/ |
| Keycloak | https://kc-interop-authzen.happyisland-d2af5d5e.westus2.azurecontainerapps.io/ |
| Ping Federate (ID Partners) | https://pingfed.idpartners.au/ |
| PingOne (ID Partners) | https://apps.pingone.asia/709b8f55-bc83-48ae-b965-89f616b7d124 |
| Thales | https://productpod-bfsi-deployment.in.tryciam.onewelcome.net/ |