Couchbase IAM federation

When deploying couchbase server in production, what are the best practices for authorisation?
For example, when using Amazon S3, you can use Federation from your identity provider to allow access from your applications. How can this be done with couchbase?

PAM or LDAP Authentication are supported by CB 4.6.0
FYI.