Identity Provider (IdP)

The central database or directory service that stores and manages identity information for principals (users, services, or devices). This is the system of record for credentials and attributes.

• Common Implementations: LDAP directories (e.g., Active Directory), SQL databases, or specialized NoSQL stores.
• Stored Data: Usernames, hashed passwords, digital certificates, user attributes (email, department), group memberships, and access policies.
• Critical Function: Serves as the authoritative source for authentication decisions and user profile data requested by Service Providers (SPs).

The software component that validates a principal's claimed identity by verifying presented credentials against the identity store. It executes the authentication protocol logic.

• Credential Verification: Validates passwords (using functions like PBKDF2), checks digital signatures, validates one-time passwords (TOTP), or confirms biometric data.
• Protocol Support: Implements standards like SAML 2.0, OpenID Connect (OIDC), and WS-Federation to communicate authentication results.
• Multi-Factor Authentication (MFA): Orchestrates step-up authentication by integrating with secondary factors (SMS, authenticator apps, security keys).

The component responsible for issuing, validating, and managing security tokens that assert authentication and authorization claims. This is the core of federated identity.

• Token Generation: Creates signed and often encrypted assertions. Common formats include SAML Assertions and JSON Web Tokens (JWT).
• Claim Packaging: Encapsulates user identity, authentication context (e.g., "MFA used"), group memberships, and other attributes within the token.
• Token Lifetime Management: Enforces expiration, handles token renewal, and manages revocation lists if supported by the protocol.

The logic layer that evaluates contextual rules to determine what a successfully authenticated user is permitted to do. It applies access control models.

• Policy Evaluation: Consults rules based on Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC).
• Contextual Factors: Can consider time of day, geolocation, device posture, and risk scores from continuous authentication systems.
• Output: Returns a permit/deny decision, often influencing the claims included in the security token issued by the STS.

The standardized HTTP(S) endpoints that expose the IdP's functionality to external Relying Parties (RPs) or Service Providers (SPs). These are the public interfaces for federation.

• Common Endpoints:
  • Single Sign-On (SSO) Service: URL where users are redirected to authenticate (e.g., /saml2/sso).
  • Metadata Endpoint: Publishes the IdP's configuration (certificates, supported protocols) for automatic SP integration.
  • Token Endpoint (OIDC): Where clients exchange an authorization code for an ID token and access token.
  • UserInfo Endpoint (OIDC): Returns standard claims about the authenticated user.

The cryptographic subsystem that safeguards the private keys used for signing tokens and assertions, and manages the public certificates shared with trusting Service Providers.

• Core Functions:
  • Signing Operations: Uses a private key to digitally sign all security tokens, proving they originated from the trusted IdP.
  • Key Storage: Often leverages a Hardware Security Module (HSM) or Key Management Service (KMS) for secure, tamper-resistant key storage.
  • Certificate Lifecycle: Manages the issuance, distribution, rotation, and revocation of X.509 certificates that contain the IdP's public key.

An authentication scheme that allows a user to log in once with a single set of credentials to gain access to multiple, independent software systems without being prompted to log in again at each one.

• Role of the IdP: The Identity Provider is the central system that enables SSO. It performs the initial authentication and then vouches for the user to various Service Providers.

• Benefits:

  • Improved User Experience: Eliminates password fatigue.
  • Enhanced Security: Centralizes authentication policy (MFA, password strength) and reduces the attack surface of password reuse.
  • Simplified Administration: User provisioning and de-provisioning are managed in one place (the IdP).

The application or service that relies on an external Identity Provider (IdP) to authenticate users. It trusts the identity assertions made by the IdP.

• In SAML: Called a Service Provider (SP).
• In OIDC/OAuth 2.0: Called a Relying Party (RP) or Client.
• Key Responsibilities:
  • Redirecting unauthenticated users to the trusted IdP.
  • Validating the signed authentication response (SAML assertion or OIDC ID Token) from the IdP.
  • Establishing a local session for the user based on the trusted identity.
  • Enforcing local authorization rules (what the user can do within the SP).

The use of shared standards and protocols (like SAML or OIDC) to link a user's digital identity across multiple separate security domains, each with its own Identity Management system.

• Core Concept: Establishes trust between an IdP in one domain and Service Providers in other domains.
• Metaphor: Like a driver's license (issued by a government IdP) being accepted by multiple entities (banks, bars, car rental SPs) to prove your identity and age.
• Key for AI Agents: Enables an autonomous agent, acting on behalf of a user, to access multiple external APIs and tools using a single, federated identity, without managing separate credentials for each service.