Identity Provider (IdP)
A system that authenticates users and issues assertions or tokens vouching for their identity to other applications. In federated single sign-on, the identity provider (for example Okta, Microsoft Entra ID, or Ping) authenticates the user once and the relying service provider trusts its assertion, using SAML or OpenID Connect. Decentralized identity removes the runtime dependency on a central IdP by letting the holder present signed credentials directly.
Concentrating authentication in one provider is the right architecture and creates the obvious dependency: the IdP is now both the highest-value target and a single point of failure. That is why break-glass paths, IdP-side threat detection, and a tested answer to "what do we do when the IdP is down or compromised" belong in the design rather than in the incident retrospective.
See also: SSO, identity orchestration, best SSO providers, federation, service provider, Okta 2023 support system breach
Related on Start with Identity
- GlossaryIdentity as a Service (IDaaS)
Identity as a Service (IDaaS) is identity and access management delivered from the cloud as a subscription: the provider runs the directory, single sign-on, MFA
- GlossarySocial Login
Letting users sign in with an existing account from a provider like Google or Apple, usually over OIDC. Reduces signup friction but ties accounts to third-party
- GlossarySSO Enforcement
SSO enforcement is an application setting that makes single sign-on through the organization's identity provider the only way to sign in, disabling or removing
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025