Identity provider
A service that authenticates users and issues assertions or tokens about them to the applications that rely on it, such as an OpenID provider or a SAML identity provider. A compromised or misconfigured identity provider affects every application that trusts it.
- Also called
- IdP
- Defined in
- NIST glossary: Identity Provider (IdP)
Covered in
SAML single sign-on: verify signed assertions without losing the identity boundary
Bind a validated SAML assertion to its trusted issuer, the exact signed element, your service, the browser request and a replay record before creating a local session, and keep your SAML library ahead of its advisories.
OAuth 2.0 and OpenID Connect login: authorization code with PKCE
Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.
Practice: OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE · Local project: Prove deprovisioning reaches sessions and queued work