Catalog
concept#Security#Integration#Architecture#Platform

Identity Provider

A central service that manages digital identities, performs authentication, and supplies user attributes to applications and APIs.

An Identity Provider (IdP) is a service that centrally manages digital identities and provides authentication and attributes to applications.
Established
High

Classification

  • High
  • Technical
  • Architectural
  • Intermediate

Technical context

Directory services (LDAP, Active Directory)Cloud platforms and SaaS apps (e.g., Azure AD, Google Workspace)API gateways and token validation services

Principles & goals

Central source of identity with minimal trust surfaceUse standardized protocols (OIDC, SAML)Principle of least privilege for attributes and tokens
Build
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Compromised IdP instance grants broad system access
  • Misconfiguration of claims leads to overprivilege
  • Incompatible standards between partners prevent federation
  • Use standardized protocols and vetted libraries
  • Implement MFA and short-lived tokens
  • Operate IdP redundantly and monitor availability and latency

I/O & resources

  • User directory (LDAP/AD) or identity data source
  • Application/service provider configuration
  • Policies for authentication, MFA and token lifetime
  • Auth tokens (OIDC JWTs, SAML assertions)
  • Audit and login logs
  • Attribute sets for connected services

Description

An Identity Provider (IdP) is a service that centrally manages digital identities and provides authentication and attributes to applications. It supports single sign-on, federated identity and centralized access control using standards such as SAML and OpenID Connect. It is key to secure, scalable access architectures.

✔

  • Reduced password management and improved user experience via SSO
  • Consistent access control and auditability
  • Enables federation and partner integration

✖

  • Single point of failure without redundancy and high availability
  • Complexity supporting legacy apps without standards
  • Administrative effort for user and attribute mapping

  • Number of successful SSO logins

    Measures successful authentications via the IdP per time unit.

  • Mean time to recover (MTTR) IdP

    Time to restore the IdP service after an outage.

  • Token issuance latency

    Average duration from auth request to token issuance.

Keycloak as central IdP

Open‑source IdP for SSO and federation used to consolidate internal applications.

Azure AD for SaaS integration

Microsoft cloud IdP for user management, SSO and B2B federation with external partners.

OIDC provider for API authentication

Use of an OIDC provider to issue access tokens for machine clients and APIs.

1

Requirements analysis (protocols, MFA, SLA)

2

Select or provision the IdP (cloud or on‑premise)

3

Integration, testing, monitoring and phased rollout

⚠️ Technical debt & bottlenecks

  • Temporary custom claims instead of a long-term attribute strategy
  • Legacy adapters for old apps without standard protocols
  • Missing automation for provisioning and certificate rotation
Provisioning/De‑provisioningToken issuance/validationAttribute mapping and schema mismatch
  • Using IdP as an authorization solution without fine-grained policies
  • Public exposure of IdP admin interface without access control
  • Relying on deprecated protocols without security updates
  • Incomplete attribute mapping leads to missing permissions
  • Untested partner integration breaks product scenarios
  • Insufficient token revocation on compromise
Knowledge of SAML, OIDC and OAuth2Understanding of directory services and provisioningOperational and security skills (HA, secrets management)
Security and traceabilityInteroperability via standardsAvailability and scalability
  • • Regulatory requirements (e.g., GDPR)
  • • Legacy applications without standard protocols
  • • Network latency and geographic distribution