{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/identity-provider","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/identity-provider/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/identity-provider/"},"term":{"en":"Identity provider","da":"Identitetsudbyder"},"aka":{"en":["IdP"],"da":["IdP"]},"domain":["cs"],"cluster":"identity","layer":"identity","status":"current","era":2002,"summary":{"en":"A trusted service that stores users' identities, checks their logins and vouches for them to other applications.","da":"En betroet tjeneste, der gemmer brugernes identiteter, kontrollerer deres login og går i god for dem over for andre programmer."},"body":{"formal":{"en":"A system that creates and maintains digital identities, performs authentication, and then sends signed statements about the user to other applications that have agreed to trust it.","da":"Et system, der opretter og vedligeholder digitale identiteter, udfører autentificering og derefter sender signerede erklæringer om brugeren til andre programmer, der har sagt ja til at stole på det."},"plain":{"en":"Like the passport office - it checks who you are once and issues a document that airlines and hotels accept without checking you from scratch.","da":"Som paskontoret - det kontrollerer én gang, hvem du er, og udsteder et dokument, som flyselskaber og hoteller godtager uden at tjekke dig forfra."},"inPractice":{"en":"A municipality runs one central identity provider for all staff; when a case officer leaves, disabling her identity there cuts off email, files and every connected app at once.","da":"En kommune bruger én central identitetsudbyder til alle medarbejdere; når en sagsbehandler stopper, lukkes hun ude af mail, filer og alle tilknyttede apps på én gang, så snart hendes identitet spærres dér."},"whyItMatters":{"en":"It gathers all logins in one place where MFA and monitoring can be enforced - and makes that place a prime target that must be guarded closely.","da":"Den samler alle login ét sted, hvor MFA og overvågning kan håndhæves - og gør det sted til et oplagt mål, der skal beskyttes nøje."}},"deepDive":{"en":"An identity provider bundles several functions that standards describe separately: an identity store or directory (Active Directory, LDAP or a cloud directory), a credential service provider that enrols and verifies authenticators, a session layer that remembers the user at the IdP, and one or more token services. In SAML it is the IdP issuing signed assertions; in OpenID Connect it is the OpenID Provider issuing ID tokens, usually combined with an OAuth 2.0 authorization server issuing access and refresh tokens. Around that sit claims transformation (mapping directory attributes to what each application expects), policy evaluation such as conditional access, and provisioning connectors, often SCIM, that push accounts into applications. Entra ID, Okta, Ping, Keycloak and AD FS are common implementations; NemLog-in plays a broker role in the Danish public sector.\n\nIts public surface is metadata. An OIDC provider publishes /.well-known/openid-configuration listing endpoints, supported flows and a jwks_uri; relying parties fetch signing keys from the JWKS and select them by the kid header, which makes key rotation routine. SAML IdPs publish XML metadata with the signing certificate embedded, and certificate rollover often breaks relying parties that configured the certificate by hand. Relying parties must validate issuer, audience, signature algorithm and key strictly; accepting any key from a shared multi-tenant endpoint is exactly the class of flaw that let Storm-0558 use a Microsoft consumer signing key against enterprise Exchange Online mailboxes in 2023.\n\nBecause it can vouch for anyone, the IdP and its signing material belong to the most sensitive tier of an estate, alongside domain controllers. The Golden SAML technique forges assertions with a stolen AD FS token-signing certificate and bypasses MFA entirely; attackers who gain IdP admin rights can instead add a federated domain or a new trusted issuer, catalogued by MITRE ATT&CK as Trust Modification (T1484.002). The IdP's support processes are part of the attack surface too: in October 2023 Okta disclosed that an attacker had accessed its support case system and taken HAR files containing customer session tokens.\n\nOperational controls follow from that: signing keys in HSMs with scheduled rotation, phishing-resistant MFA and privileged access workstations for IdP administrators, alerting on changes to federation trusts, application credentials and policies, and export of sign-in and audit logs to a SIEM. Availability matters as much as integrity, since an IdP outage stops every connected application; emergency access accounts and documented fallback procedures address that. An IdP is distinct from the relying parties that consume its statements, and from an authorization server that issues access tokens without asserting identity, although a single product usually plays all these roles.","da":"En identitetsudbyder samler flere funktioner, som standarderne beskriver hver for sig: et identitetslager eller directory (Active Directory, LDAP eller et clouddirectory), en credential service provider, der registrerer og verificerer autentifikatorer, et sessionslag, der husker brugeren hos IdP'en, og en eller flere tokentjenester. I SAML er det IdP'en, der udsteder signerede assertions; i OpenID Connect er det OpenID Provideren, der udsteder ID-tokens, som regel kombineret med en OAuth 2.0-autorisationsserver, der udsteder adgangs- og refresh-tokens. Omkring det ligger transformation af claims (tilpasning af directory-attributter til det, hver applikation forventer), politikevaluering som betinget adgang og provisioneringskonnektorer, ofte SCIM, der opretter konti i applikationerne. Entra ID, Okta, Ping, Keycloak og AD FS er udbredte implementeringer; NemLog-in har en brokerrolle i den danske offentlige sektor.\n\nDen offentlige flade er metadata. En OIDC-udbyder udgiver /.well-known/openid-configuration med endpoints, understøttede flows og en jwks_uri; relying parties henter signeringsnøgler fra JWKS og vælger dem ud fra kid-headeren, så nøglerotation bliver rutine. SAML-IdP'er udgiver XML-metadata med signeringscertifikatet indlejret, og certifikatskift får ofte relying parties, der har konfigureret certifikatet manuelt, til at fejle. Relying parties skal validere udsteder, audience, signaturalgoritme og nøgle stramt; at acceptere en hvilken som helst nøgle fra et fælles multi-tenant-endpoint er netop den type fejl, der lod Storm-0558 bruge en af Microsofts signeringsnøgler til forbrugerkonti mod virksomheders Exchange Online-postkasser i 2023.\n\nFordi den kan gå i god for hvem som helst, hører IdP'en og dens signeringsmateriale til det mest følsomme lag i et IT-miljø sammen med domænecontrollerne. Teknikken Golden SAML forfalsker assertions med et stjålet token-signeringscertifikat fra AD FS og omgår MFA fuldstændigt; angribere med administratorrettigheder i IdP'en kan i stedet tilføje et fødereret domæne eller en ny betroet udsteder, hvad MITRE ATT&CK kalder Trust Modification (T1484.002). IdP'ens supportprocesser er også en del af angrebsfladen: I oktober 2023 oplyste Okta, at en angriber havde fået adgang til virksomhedens supportsagssystem og taget HAR-filer med kunders sessionstokens.\n\nDe driftsmæssige kontroller følger heraf: signeringsnøgler i HSM med planlagt rotation, phishing-resistent MFA og privilegerede arbejdsstationer til IdP-administratorer, alarmer ved ændringer af føderationstillid, applikationers loginoplysninger og politikker samt eksport af login- og audit-logs til et SIEM. Tilgængelighed er lige så vigtig som integritet, for et nedbrud hos IdP'en stopper alle tilknyttede applikationer; nødkonti og dokumenterede reserveprocedurer tager højde for det. En IdP er forskellig fra de relying parties, der bruger dens erklæringer, og fra en autorisationsserver, der udsteder adgangstokens uden at erklære noget om identitet, selv om ét produkt som regel spiller alle rollerne."},"edges":[{"type":"requires","to":"cs/identity","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/authentication","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/mfa","why":{"en":"The identity provider is the natural place to require MFA once for every connected application.","da":"Identitetsudbyderen er det naturlige sted at kræve MFA én gang for alle tilknyttede programmer."},"confidence":"high","strength":"normal"}],"depth":3,"sources":[{"title":"NIST SP 800-63C, Federation and Assertions","url":"https://pages.nist.gov/800-63-3/sp800-63c.html","tier":"standard","publisher":"NIST"}],"draft":true}