In January 2025 the IETF published RFC 9700, which tells clients to stop using two OAuth flows that many identity books still teach: the implicit grant and the password grant. That changes how you pick identity and access management books, because a clear 2017 chapter on the implicit flow will walk you straight into a client design your auditors ought to reject.
This list covers eight books for people who run Keycloak, FreeIPA-backed single sign-on or any OpenID Connect provider. It holds one hands-on Keycloak manual, three protocol books on OAuth 2 and OIDC, two on identity architecture and two on identity attacks and machine identity. We checked every edition against its publisher record or companion repository in October 2026 and confirmed a new copy sold by Amazon for each, so no pick sends you to a replaced edition or a used-only listing.
Eight books and the gap each one covers
Every book here closes one gap in how a team runs identity and leaves another open. The third column matters most: a book written before RFC 9700 is not wrong, but you will have to correct its flow advice yourself as you read.
| Book | What it covers | Before RFC 9700? | Hands-on code | Price band |
|---|---|---|---|---|
| Keycloak: Identity and Access Management for Modern Applications, 2nd ed. | Running Keycloak, OIDC clients, federation, MFA | Yes (2023) | Yes, Keycloak 22 | about $55 to $60 |
| Solving Identity Management in Modern Applications, 2nd ed. | OAuth 2, OIDC and SAML 2 for app teams | Yes (2022), with an OAuth 2.1 overview | Sample app discussion | about $40 to $65 |
| OAuth 2 in Action | Building a client, server and resource from scratch | Yes (2017) | Yes, Node.js | about $50 |
| Cloud Native Data Security with OAuth | OAuth for APIs and workloads on Kubernetes | No (April 2025) | Yes, per-chapter repo | about $35 to $60 |
| Learning Digital Identity | Identity architecture, federation, decentralized identity | Yes (2023) | No | about $30 to $56 |
| Identity-Native Infrastructure Access Management | Secretless access to servers, databases and clusters | Yes (2023) | No | about $33 to $46 |
| Identity Attack Vectors, 2nd ed. | How identities and privileges get abused | Yes (2024) | No | about $50 to $60 |
| Identity Security for Software Development | Secrets and machine identity in code and CI/CD | No (June 2025) | No | about $35 to $60 |
Prices are the Amazon US range on our check date, from the sale price to the list price, and they move weekly, so check the current price before ordering. With budget for only one, buy the book for the system you are responsible for today. An admin who runs a Keycloak realm gets more from the Keycloak manual than from any protocol book, while a developer writing the API behind it needs the protocol book first.
Flows the older books still teach
Six of these eight books went to print before RFC 9700, the OAuth 2.0 Security Best Current Practice, which updates RFC 6749 and turns years of informal guidance into requirements. The protocol did not change underneath them. What changed is which parts of it you are allowed to use. The security BCP was a public draft for years, but a book printed before it was final could only guess which drafts would become rules.
Treat any pre-2025 chapter as correct only where it agrees with these four rules from the RFC:
- No client uses the implicit grant (
response_type=token); section 2.1.2 says clients should not. - No client uses the resource owner password credentials grant; section 2.4 says it must not be used.
- Every public client uses PKCE (S256), and the authorization server supports and enforces it.
- Refresh tokens issued to public clients are sender-constrained or rotated on every use.
The redirect URI rule belongs with them: the RFC requires exact string matching (with a port exception for localhost redirects in native apps), which rules out the wildcard redirect URIs that Keycloak and many other providers still let you configure. OAuth 2.1 folds the same rules into the core spec, but it is still an Internet-Draft. Revision 17 is dated October 31, 2026 on the IETF datatracker, so any book that claims to teach “OAuth 2.1” is teaching a draft, and you should read it that way.
Hands-on Keycloak and single sign-on
Most people who search for a Keycloak book already have a realm running and a list of apps to put behind it. There is one book written by the people who build Keycloak, and it is the place to start for that job.
Keycloak: Identity and Access Management for Modern Applications, 2nd Edition
Stian Thorgersen is the Keycloak project lead and Pedro Igor Silva was a Red Hat engineer on the project when they wrote it, so the advice on realms, clients and token settings comes from the source. Packt published the second edition in July 2023 at 350 pages.
The companion repository lists Keycloak 22, Docker, JDK 17 and Node.js 18 as the lab stack, and it targets the Quarkus-based distribution with the new admin console. That is the same architecture Keycloak runs today, so the concepts, the kc.sh start options and most admin screens carry over. The version gap is real, though: Keycloak 26.8.1 shipped on October 13, 2026 as a security release, four major versions after the lab release. Run the examples on a current release, and expect some console labels and defaults to differ from the screenshots.
The chapters follow the order you’ll configure things in. Chapters 4 to 6 cover OpenID Connect, OAuth 2.0 with PKCE, the device grant and token introspection, and chapter 8 covers role, group and attribute-based authorization plus the Keycloak authorization services. Chapter 9 handles production (TLS, the database, clustering and the reverse proxy). Chapter 10 covers LDAP and Active Directory federation with external identity providers, and chapter 11 covers OTP and WebAuthn. Chapter 14 on securing Keycloak itself is the one to read before you expose the admin console.
Buy it if you run Keycloak or plan to. It pairs well with our guides to running Keycloak in Docker or Podman with TLS and federating Keycloak with FreeIPA over LDAP and Kerberos, which apply chapters 9 and 10 to a current release. Pass on it if you deploy on Kubernetes and want operator coverage: the repository describes Docker and OpenJDK only, so our Keycloak operator walkthrough with CloudNativePG fills that gap. It sells for about $55 to $60, so check the current price on Amazon.
OAuth 2 and OpenID Connect at protocol depth
You cannot spot a bad client setting without knowing what each parameter protects, and that knowledge comes from the protocol, not the admin console. These three books teach the protocol itself, from three directions: the application team, the implementer and the API platform.
Solving Identity Management in Modern Applications, 2nd Edition
Yvonne Wilson and Abhishek Hingnikar wrote this for developers who have to add login, logout and API authorization to an application and want the standards explained in that order. The Apress second edition from November 2022 runs to 22 chapters and 413 pages.
It covers OAuth 2, OpenID Connect and SAML 2 in one place, which is rare. That matters when a single product has to accept a SAML login from an enterprise customer and issue OIDC tokens to its own mobile app. The second edition adds an overview of OAuth 2.1 (what it removes from 2.0 and why), the device authorization grant from RFC 8628, Rich Authorization Requests and JWT-secured authorization requests. It also keeps separate chapters on sessions, logout and failure handling, which most protocol books skip and most production bugs come from.
This is the best first protocol book for an application team, and its OAuth 2.1 overview means it already points you away from the implicit and password grants. Pass on it if you need to build an authorization server, since it explains the protocols from the client and app side. Expect to pay about $40 to $65, and check the live price before ordering.
OAuth 2 in Action
Justin Richer and Antonio Sanso teach OAuth by having you build every role yourself, which is still the fastest way to understand why each check exists. Manning published it in March 2017, and it has not had a second edition.
The companion code is JavaScript on Node.js: you run npm install in each exercise, then start the client on port 9000, the authorization server on 9001 and the protected resource on 9002 in separate terminals. Writing the token endpoint yourself makes the security part of the book land, because you’ve just written the code that each vulnerability abuses. Later chapters cover dynamic client registration, token introspection and revocation, JOSE, OpenID Connect and UMA.
Its age is the risk. The book predates RFC 9700 by almost eight years, so read every flow recommendation against the four rules above and do not copy its implicit-flow guidance into a new client. Buy it if you implement or review OAuth servers and libraries. Pass on it if you only configure an identity provider, because the depth won’t pay off. It sells for about $50; check the current price on Amazon.
Cloud Native Data Security with OAuth
Gary Archer, Judith Kahrer and Michał Trojanowski are identity specialists at Curity, and their O’Reilly book from April 2025 is the newest protocol title on this list. It is also the only protocol book here published after RFC 9700.
The book treats the access token as the unit of zero trust: every API checks claims in the token instead of trusting the network it sits on, and the security components run inside a Kubernetes cluster. The example repository maps code to chapters, including SCIM user migration, a zero trust API, API gateway extensions, entitlements, workload identities, browser-based apps and user authentication. That is the material platform teams usually have to piece together from vendor blogs.
Curity offers the full text free on its website, so you can read a chapter before you decide on print. Buy the paperback if you design API platforms on Kubernetes and want a reference on the desk. The example repository deploys the community edition of the Curity Identity Server by default, so expect to adapt it if you run Keycloak. Pass on it if you run a single monolith behind one SSO login, since most of the book assumes many APIs and many workloads. Expect about $35 to $60, and check the live price.
Identity architecture beyond one login page
Once SSO works, the next failures are architectural: users copied into four directories, admins with standing SSH keys and service accounts no one owns. These two books step back from the protocol and ask where identity should live.
Learning Digital Identity
Phillip J. Windley wrote this O’Reilly book, published in February 2023, and it is the broadest identity text here, at 469 pages with a foreword by Drummond Reed.
It separates authentication from authorization, then walks through centralized, federated and decentralized identity, ending at self-sovereign identity and the trust, risk and privacy questions each model raises. That framing helps when you have to justify an architecture, for example why a FreeIPA domain should feed Keycloak instead of every app binding to LDAP directly. It also makes the case against building your own identity system, which is the argument you’ll need when a team wants to.
Architects and security leads get the most from it. Pass on it for configuration help, because the book works at the architecture level, with little product detail. It costs about $30 to $56; check the current price on Amazon.
Identity-Native Infrastructure Access Management
Ev Kontsevoy, Sakshyam Shah and Peter Conrad wrote a short book, 154 pages from O’Reilly in October 2023, about one exposure: the long-lived secrets engineers use to reach servers, databases and clusters.
The argument is that static SSH keys, database passwords and kubeconfig tokens are easy to steal and make audit logs meaningless, so access should come from digital certificates tied to a verified identity. Eight chapters build that case through four pillars of access (connectivity, authentication, authorization and audit), then cover scaling it across servers, databases, Kubernetes pods and internal apps such as Jenkins and GitLab. It’s the same reasoning behind Kerberos tickets in a FreeIPA domain, applied to the whole stack.
Kontsevoy is the CEO of Teleport and Shah is a Teleport engineer, so the book argues for the model their product sells, and you should weigh it that way. Get it if you own infrastructure access for a team of engineers. Pass on it if your identity work stops at application SSO. Expect about $33 to $46, and check the live price.
Attacks on identities, human and machine
An attacker who holds a valid token doesn’t need an exploit. These two books cover how identities, privileges and secrets get stolen and abused, one from the security program side and one from the developer’s.
Identity Attack Vectors, 2nd Edition
Morey J. Haber was chief security officer at BeyondTrust and Darran Rolls a SailPoint security executive when the book came out. Apress published their second edition in March 2024 with 24 chapters.
The book treats accounts, credentials, roles and entitlements as attack surface and maps them to the cyber kill chain, covering human and machine identities, privileged accounts, discovery and Zero Trust. It is written for the people who run an identity governance or privileged access program, so it asks which accounts exist, who approved them and what they can reach. Those are the questions an identity audit asks, and the book gives you the vocabulary to answer them for a board as well as for an auditor.
Buy it if you own identity risk for an organization. Pass on it for protocol or product configuration, since there’s none. Apress has a related title, The Identity Attack Lifecycle, on pre-order and due in February 2027, but it is not out yet. Don’t wait on it. This one sells for about $50 to $60; check the current price on Amazon.
Identity Security for Software Development
John Walsh, Uzi Ailon and Matt Barker published this O’Reilly book in June 2025, and it is the most recent pick here, at 205 pages.
Its subject is the identity no one logs in with: the secrets, credentials and machine identities inside application code, CI/CD pipelines, Kubernetes, multicloud deployments and IoT, plus how those identities become a supply chain risk. That is the gap the user-focused books on this list leave open. It is also where a leaked pipeline token or a client secret committed to Git hands an attacker the same access a stolen admin password would.
Developers and DevOps engineers who own pipelines get the most from it. Pass on it for SSO or directory guidance, because user federation is not its focus. Expect about $35 to $60, and check the live price before buying.
The directory gap: FreeIPA, LDAP and Kerberos
We found no current book from a technical publisher that covers FreeIPA. An Amazon catalog search for FreeIPA returned workbook-style “A Complete Guide” and “Clear and Concise Reference” titles from 5STARCooks, priced from $88 to $166, plus a few general identity titles, and none of them is a technical guide to the product. The classic directory books are two decades old: O’Reilly’s LDAP System Administration came out in April 2003 and Kerberos: The Definitive Guide in September 2003. Their protocol chapters still hold, but their install steps and tooling don’t match anything you’d deploy now.
For the directory layer, the Red Hat Identity Management documentation and hands-on guides are the current material. Our series starts with installing a FreeIPA server on Rocky Linux and AlmaLinux, continues with the FreeIPA sudo rules cookbook, and covers plain directories in our OpenLDAP server guide for Ubuntu. Read those for the directory, and use the Keycloak book for the SSO layer that sits on top of it.
Two good books did not make the list for a buying reason, not a quality one. Neil Madden’s API Security in Action (Manning, 2020) showed only a used copy from a third-party seller in the Amazon buy box on our check date. Aaron Parecki’s OAuth 2.0 Simplified (second edition, 2018) was down to a single third-party copy. Look for both from the publisher directly if you want them.
Reading order by role
Pick the order by what you’re accountable for, because the wrong first book costs weeks of reading that will not touch your systems:
- You run Keycloak for internal apps: the Keycloak 2nd edition, then Solving Identity Management for the protocol detail behind each client setting.
- You write applications that log users in: Solving Identity Management first, then OAuth 2 in Action read against RFC 9700.
- You build an API platform on Kubernetes: Cloud Native Data Security with OAuth, then Identity Security for Software Development.
- You own infrastructure access for engineers: Identity-Native Infrastructure Access Management, then Identity Attack Vectors.
- You set identity strategy or pick the IdP: Learning Digital Identity, then our Keycloak, authentik, Zitadel and Authelia comparison.
If you also run detection for the same environment, our list of threat hunting books covers the SOC side, where stolen identities show up as alerts.
Identity audit checklist to run after reading
Reading only helps if it changes a setting. Run these checks against your own identity provider after finishing the book for your role. Fix each failure before moving to the next one:
- No client in any realm has the implicit flow enabled.
- No client accepts the resource owner password grant (Keycloak calls it direct access grants).
- Every public client requires PKCE with the S256 method.
- Every redirect URI is an exact URL, with no wildcards.
- Refresh tokens for public clients are sender-constrained or rotate on each use.
- The identity provider runs its vendor’s latest security release.
- Directory federation connects over LDAPS or StartTLS, never plain LDAP.
- Every admin account on the identity provider requires a second factor.
- No pipeline holds a long-lived client secret that a short-lived workload identity could replace.
Items 1 to 5 follow RFC 9700 (item 1 and the S256 part of item 3 are SHOULD-level there, the rest MUST) and fail most often on realms that were set up years ago and never revisited. Items 6 to 9 are where the architecture and attack books earn their price: each one closes a path an attacker with a single stolen credential would otherwise walk through.
