An identity provider authenticates a person or other subject and issues a protected assertion to a relying party. The relying party validates that assertion and uses its contents to establish a local session or support another transaction.
Federation protocols such as OpenID Connect and Security Assertion Markup Language define how assertions and related metadata move between parties. The trust agreement and implementation must define accepted issuers, keys, audiences, subject identifiers, attributes, assurance, lifetimes, and privacy rules. Local account mapping, provisioning, and authorization remain responsibilities of the relying service or connected lifecycle systems.
Key points
Trust establishmentParties agree how issuers and relying parties are identified, how keys and metadata are maintained, and which protocol profiles are accepted.
Assertion validationCheck issuer, signature, audience, time bounds, transaction binding, subject mapping, and other protections required by the chosen protocol.
Lifecycle and privacyLimit released attributes, handle identifier changes, revoke or disable access promptly, and understand what activity the identity provider can observe.
Important limitationFederation shifts and concentrates trust; it does not eliminate compromise. Stolen signing keys, unsafe account linking, replayable assertions, weak authentication, or a compromised identity provider can affect every relying party that accepts the result.