auth and sso

Authentication(单系统内)

技术	说明
用户名+密码	配合 bcrypt/argon2 哈希存储
Session + Cookie	服务端存 session,最传统成熟的 Web 方案
JWT	自包含 token,适合无状态 API
MFA/2FA	TOTP(Google Authenticator)、短信、硬件密钥
WebAuthn / Passkeys	基于公钥的无密码登录,现在主流浏览器都支持
LDAP / Kerberos	企业内网老牌方案,AD 域的基础

常见组合:新项目基本是 OIDC + JWT;对接企业客户往往还得额外支持 SAML。托管方案有 Okta、Auth0、Keycloak(开源)、Azure Entra ID。

---

English coaching note

Your question in English:

• "Could you list the most common and mature technologies for authentication and SSO?" — clean and natural.
• 「Authentication 和 SSO 之间」→ careful here: "between A and B" implies something connecting them. Since you meant "for each of these two areas," English would say "for authentication and for SSO" or "in each area."
• "mature" is exactly the right word — it's standard in English tech discussion for well-established, battle-tested technology.