Cybersecurity glossary
What is an Identity Provider (IdP)?
Learn what an identity provider (IdP) is, how it authenticates users for SSO with SAML or OIDC, why the IdP is a high-value target, and how to harden IdP configuration.
Definition
An Identity Provider (IdP) is a service that authenticates users (and sometimes devices or workloads) and issues security assertions or tokens that relying applications trust for single sign-on and federated identity.
Why applications outsource login to an IdP
Maintaining separate passwords in every SaaS tool is fragile. An Identity Provider (IdP) centralizes authentication, MFA policy, and often user provisioning so applications can focus on their own authorization and business logic.
That centralization is the point—and the blast radius.
What an IdP does
Authenticate subjects
Verify passwords, passkeys, MFA, device posture, or federated upstream identities.
Issue assertions or tokens
Produce SAML assertions, OIDC ID tokens, and often OAuth access tokens.
Enforce policy
Conditional access, adaptive risk, and group-based app assignment.
Broker federation
Connect workforce directories, partner IdPs, and customer identity sources.
Support provisioning
Push or sync accounts and groups via SCIM or directory connectors.
Provide admin & audit
Manage apps, roles, and emit authentication telemetry for security teams.
Typical SSO sequence
User opens an application
The relying party finds no local session and redirects to the IdP.
IdP authenticates
Primary factor plus MFA or passkey according to policy.
IdP returns a proof
SAML Response or OIDC tokens convey subject and authentication context.
App validates the proof
Signature, audience, issuer, times, and nonce/state checks run server-side.
Local session created
The app authorizes features based on claims, groups, or local policy.
Trust boundaries to get right
| Boundary | If weak | Control |
|---|---|---|
| User → IdP | Account takeover of master login | Phishing-resistant MFA, monitoring |
| IdP → apps | Forged or accepted-bad assertions | Strict crypto validation, audience checks |
| IdP admins | Silent app-wide compromise | PAM, JIT admin, immutable logs |
| Lifecycle sync | Orphan access after offboarding | SCIM + session revocation |
Hardening checklist
- Enforce phishing-resistant MFA for administrators and preferably all workforce users.
- Limit IdP admin roles; require just-in-time elevation and session recording where available.
- Validate every assertion/token field apps rely on; never skip signature verification.
- Shorten IdP and application session lifetimes; re-auth for sensitive apps.
- Automate deprovisioning and revoke refresh tokens on termination.
- Monitor impossible travel, MFA fatigue, and new MFA device enrollments.
- Maintain break-glass accounts with offline procedures and intensive alerting.
- Review connected apps and OAuth grants regularly for least privilege.
The practical takeaway
An Identity Provider (IdP) is the authentication authority other apps trust for SSO. Harden it like production infrastructure: strong authenticators, tight admin access, strict federation validation, and fast offboarding.
If the IdP is solid, many applications inherit better security. If it is weak, many applications inherit the same outage or breach at once.
Related security terms
Single Sign-On (SSO)
User experience typically powered by a central IdP.
OpenID Connect (OIDC)
Modern protocol many IdPs use to authenticate users to apps.
SAML
Enterprise federation protocol commonly offered by IdPs.
ID Token
OIDC token issued by an IdP to prove user authentication.
Identity and Access Management (IAM)
Broader program in which the IdP is a core control.
Frequently asked questions
What is an IdP in simple terms?
An identity provider is the central login service apps trust. You sign in once there, and it tells other applications who you are.
How is an IdP different from a service provider?
The IdP authenticates and asserts identity. The service provider (or relying party) consumes that assertion to create a local application session.
Which protocols do IdPs use?
Commonly SAML 2.0 for enterprise apps and OpenID Connect (on OAuth 2.0) for modern web and mobile apps. Some also support WS-Fed or proprietary connectors.
Why is the IdP a high-value target?
Compromising the IdP—or a highly privileged IdP session—can unlock many connected applications at once.
Should MFA be enforced at the IdP?
Yes for workforce access. Central MFA at the IdP is one of the highest-leverage controls in an SSO environment.
What is IdP-initiated vs SP-initiated SSO?
SP-initiated starts at the application and redirects to the IdP. IdP-initiated starts from an IdP portal. SP-initiated with strict validation is generally easier to reason about securely.
How do you harden an IdP?
Phishing-resistant MFA, least-privilege admin roles, strong federation validation, session controls, SCIM offboarding, logging, and break-glass procedures that are monitored.
References
Explore authoritative guidance and frameworks related to identity provider (idp).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.