ISPid

ISPid stands for Identity Service Provider Identifier, a concept used in federated identity systems to provide a stable, lightweight reference to an identity service provider within a given ecosystem. It functions as a canonical handle that discovery services, metadata repositories, and relying parties can use to locate the appropriate IdP during authentication and attribute exchange. ISPid is not an authentication mechanism itself; it identifies the party that performs authentication.

The exact syntax and scope of an ISPid vary by federation or protocol. Common patterns include URIs, namespaced strings, or registry lookups. In practice, ISPid values are registered in metadata registries or discovery services and are resolved to endpoint URLs, certificates, and supported bindings. Because there is no universal standard, implementations differ across organizations and federations.

ISPid is often used alongside established protocols such as SAML 2.0, OpenID Connect, and WS-Federation. It is similar in purpose to traditional identifiers like an entityID or issuer but is intended to be more portable across different federation boundaries and discovery mechanisms. The approach helps decouple external identity references from internal network configurations and routing logic.

Security and governance of ISPid rely on trusted registries, proper binding to a provider’s trust anchors, and secure discovery processes. Changes to an IdP’s metadata can affect ISPid resolution, requiring versioning, revocation, and synchronization across relying parties. Interoperability can be a challenge where federations adopt different naming conventions or registry schemas.

See also: OpenID Connect, SAML 2.0, Federated identity, EntityID, Issuer.