Service Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party.
The service provider does the validation, and therefore owns most of the risk in a federation. Checking the signature is necessary and not sufficient: the assertion must be for this SP, recent, unreplayed, and from the expected issuer with an algorithm you chose rather than one the message declared. A long run of SAML bypasses come from skipping one of those.
See also: identity provider, relying party, SAML 2.0, federation
Related on Start with Identity
- GlossarySSO
SSO (single sign-on) is an authentication setup in which a user signs in once at an [identity provider](/glossary/identity-provider/) and then reaches many appl
- GlossaryDirectory Service
A directory service is the system that stores an organization's identities and their attributes (users, groups, devices, service accounts) in one queryable data
- GlossaryIdentity Fabric
An identity fabric is an architecture, not a product: a set of identity services from one or more vendors (identity provider, governance, privileged access, orc
- CVEKeycloak accepts SAML from a disabled identity provider
A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a cont
- CVEruby-saml denial of service via compressed SAML messages
A compressed SAML message can be inflated into a resource-exhaustion hit against ruby-saml. Not an impersonation bug, but it sits in the same March 2025 patch t
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the