Identity Federation
Identity federation is a trust arrangement in which one party, the identity provider, authenticates a user and another party, the service provider or relying party, accepts a signed assertion of that identity instead of holding its own password for the user. The standards are SAML 2.0 and OpenID Connect. Federation is the foundation of SSO, within one organization and between organizations.
| Federation | Not the same as |
|---|---|
| Trust between separate parties, expressed as signed assertions and exchanged metadata | Directory synchronization, which copies accounts and often password hashes |
| The mechanism | SSO, which is the user experience federation makes possible |
| Can span companies (partner or B2B access) | A shared account used by several organizations |
Federation is the reason an employee has one login instead of forty, and also the reason one compromised login opens forty systems. That trade is worth making, but it changes where the security work goes: into the identity provider, into session lifetime, and into what happens when the assertion itself can be forged. Most catastrophic SAML bugs are federation bugs, where a service provider accepted an assertion it should have rejected.
See also: SSO, SAML 2.0, OpenID Connect, SAML vs OIDC
Related on Start with Identity
- GlossarySSO Identifier (SSO ID)
An SSO identifier, or SSO ID, is the value an identity provider sends to an application to say which user just signed in: the `NameID` in a [SAML](/glossary/sam
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025
- CVEFortiWeb FortiCloud SSO SAML bypass
The FortiWeb twin of CVE-2025-59718. A crafted SAML message bypasses FortiCloud SSO on FortiWeb. Same CWE-347 class, same December 2025 window, same 'patch or d
- BlogGitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoning
GitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-li
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- GlossaryID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not f