IdP

An Identity Provider (IdP) is a system that creates, maintains, authenticates, and provides identity information about users to other trusted parties. It is a component of identity and access management and is commonly used to enable single sign-on across multiple applications and services.

In typical use, a user attempts to access a service provider (SP). The SP redirects the user to the IdP for authentication. The IdP verifies the user’s identity, potentially using credentials, tokens, and multi-factor authentication, and then issues an authentication assertion or token back to the SP to grant access.

IdPs support standard protocols such as SAML 2.0, OpenID Connect, and OAuth 2.0. SAML provides XML-based assertions, while OpenID Connect builds on OAuth 2.0 to issue signed ID tokens (JWTs) that convey the user’s identity and other attributes.

Common features include centralized authentication, integration with user directories (LDAP, Active Directory, cloud directories), attribute release (claims) to relying parties, single sign-on across domains, session management, and optional provisioning of accounts to connected applications (often via SCIM).

IdPs come in cloud-based and on-premises forms. Examples include Okta, Microsoft Entra ID, Ping Identity, OneLogin, and Auth0 for cloud offerings, and on-premises solutions such as Active Directory Federation Services (AD FS). Federations enable trusted authentication across organizational boundaries.

Security considerations include maintaining trust through secure metadata exchange and certificate management, signing and verifying assertions, and implementing strong multi-factor authentication. Because the IdP is a central point of authentication, a breach can affect many connected services; proper phishing resistance and monitoring are essential.