Identity provider

An identity provider bundles several functions that standards describe separately: an identity store or directory (Active Directory, LDAP or a cloud directory), a credential service provider that enrols and verifies authenticators, a session layer that remembers the user at the IdP, and one or more token services. In SAML it is the IdP issuing signed assertions; in OpenID Connect it is the OpenID Provider issuing ID tokens, usually combined with an OAuth 2.0 authorization server issuing access and refresh tokens. Around that sit claims transformation (mapping directory attributes to what each application expects), policy evaluation such as conditional access, and provisioning connectors, often SCIM, that push accounts into applications. Entra ID, Okta, Ping, Keycloak and AD FS are common implementations; NemLog-in plays a broker role in the Danish public sector.

Its public surface is metadata. An OIDC provider publishes /.well-known/openid-configuration listing endpoints, supported flows and a jwks_uri; relying parties fetch signing keys from the JWKS and select them by the kid header, which makes key rotation routine. SAML IdPs publish XML metadata with the signing certificate embedded, and certificate rollover often breaks relying parties that configured the certificate by hand. Relying parties must validate issuer, audience, signature algorithm and key strictly; accepting any key from a shared multi-tenant endpoint is exactly the class of flaw that let Storm-0558 use a Microsoft consumer signing key against enterprise Exchange Online mailboxes in 2023.

Because it can vouch for anyone, the IdP and its signing material belong to the most sensitive tier of an estate, alongside domain controllers. The Golden SAML technique forges assertions with a stolen AD FS token-signing certificate and bypasses MFA entirely; attackers who gain IdP admin rights can instead add a federated domain or a new trusted issuer, catalogued by MITRE ATT&CK as Trust Modification (T1484.002). The IdP's support processes are part of the attack surface too: in October 2023 Okta disclosed that an attacker had accessed its support case system and taken HAR files containing customer session tokens.

Operational controls follow from that: signing keys in HSMs with scheduled rotation, phishing-resistant MFA and privileged access workstations for IdP administrators, alerting on changes to federation trusts, application credentials and policies, and export of sign-in and audit logs to a SIEM. Availability matters as much as integrity, since an IdP outage stops every connected application; emergency access accounts and documented fallback procedures address that. An IdP is distinct from the relying parties that consume its statements, and from an authorization server that issues access tokens without asserting identity, although a single product usually plays all these roles.