Relying Party (RP)
The application that relies on an external identity provider to authenticate users. The term is used in OIDC and WebAuthn. The RP validates tokens or assertions but does not store user credentials itself.
Being a relying party means outsourcing authentication and keeping responsibility for validation, which is where the bugs live: accepting an assertion without checking the audience, trusting a signature algorithm the attacker chose, or treating an ID token as an API credential. In WebAuthn the RP identifier is also the security boundary, since it determines which origin a credential will sign for.
See also: identity provider, OpenID Connect, WebAuthn and FIDO2, validate a JWT recipe
Related on Start with Identity
- GlossarySSO
SSO (single sign-on) is an authentication setup in which a user signs in once at an [identity provider](/glossary/identity-provider/) and then reaches many appl
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- GlossaryDirectory Service
A directory service is the system that stores an organization's identities and their attributes (users, groups, devices, service accounts) in one queryable data
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- BlogGitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoning
GitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-li
- CVEKeycloak session hijack via prompt=login re-authentication
Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Pa