A practical map of identity, OAuth 2.1, OpenID Connect, PKCE, security token services, on-behalf-of delegation, hardened profiles, threats, and operations.