Identity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other party. Federation is the foundation of cross-organization SSO.
Federation is the reason an employee has one login instead of forty, and also the reason one compromised login opens forty systems. That trade is worth making, but it changes where the security work goes: into the identity provider, into session lifetime, and into what happens when the assertion itself can be forged. Most catastrophic SAML bugs are federation bugs, where a service provider accepted an assertion it should have rejected.
See also: SSO, SAML 2.0, OpenID Connect, SAML vs OIDC
Related on Start with Identity
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025
- CVEFortinet follow-on SSO SAML bypass after the 59718 patch
A second FortiCloud SSO SAML bypass that hits devices already patched for CVE-2025-59718 and CVE-2025-59719. Actively exploited. CISA guidance 28 January 2026.
- CVEFortiWeb FortiCloud SSO SAML bypass
The FortiWeb twin of CVE-2025-59718. A crafted SAML message bypasses FortiCloud SSO on FortiWeb. Same CWE-347 class, same December 2025 window, same 'patch or d
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- GlossaryID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not f
- GlossaryRelying Party (RP)
The application that relies on an external identity provider to authenticate users. The term is used in OIDC and WebAuthn. The RP validates tokens or assertions