intermediërid

Intermediërid is a term used in digital identity management to describe an intermediary identifier that represents a user to a relying party while masking the user's primary identifier. It is often discussed in the context of identity brokering, federated authentication, and privacy-preserving login flows. An intermediërid may be issued by an identity provider or a trusted broker and can be rotated, scoped to a specific service, or tied to a single session to limit cross-service linkability.

In practice, the intermediërid acts as a proxy for the user, allowing the service to perform authorization decisions without directly handling the user's real identifier. It is commonly implemented as a subject identifier or pseudonymous token that the relying party can map to the user's account through a trusted backend. The approach helps reduce exposure of personal data, supports privacy by design, and enables revocation or reissuance without changing the user's primary credentials.

Security and privacy considerations are central to its use. The validity and scope of the intermediërid depend on the trust in the intermediary; if the broker is compromised or mismanages mappings, broader exposure or identity linkage can occur. Proper controls include per-transaction or per-session rotation, explicit consent, auditable logging, and timely revocation or reissuance procedures.

Relation to standards and practice: the concept intersects with established identity protocols and practices, such as those found in OpenID Connect and SAML, where different forms of subject identifiers can be issued or mapped. It is also relevant to privacy-preserving techniques that minimize direct exposure of real identifiers to relying parties.

See also: identity federation, identity brokering, pseudonymous identifiers, privacy-preserving authentication.