[victorNicollet]

We use SAML set up for our customers' identity providers (most of the time, Office365 Azure AD or Google Suite), from a NuGet package.

From there, it's a bearer token encoded in JWT format for ease of debugging. From another NuGet.

We also support username and public key authentication for our SFTP server.

We do support username and password if necessary.

[baq]

and what do you use for authorization?

[victorNicollet]

Custom rules on top of ASP.NET middleware.