Identity resilience glossary
Identity provider (IdP)
An identity provider (IdP) is a service that authenticates a user and provides an application with evidence of that authentication. In a federated sign-in, the application relies on an assertion or token from the IdP instead of verifying the user's authenticator itself. The application is called a relying party. NIST's federation guidance defines these roles and their trust relationship.
Why it matters
This arrangement lets organizations manage authentication centrally while connecting users to separate applications. It also makes the configuration connecting the IdP and each application operationally important. A working account alone does not establish that the application trusts the right issuer or receives the identity information it expects.
Illustrative identity example
An employee opens a reporting application that redirects sign-in to the organization's IdP. After authentication, the IdP sends a signed assertion identifying the employee. The application validates the assertion and creates its own session. If an administrator incorrectly changes the application's trust configuration, sign-in may fail even though the employee can authenticate to the IdP.
Common confusion
An IdP is not simply a directory of accounts. A directory can supply account information, while the IdP performs the federation role. Authentication is also different from authorization: an application can recognize a user without granting that user every function or record. Protecting IdP configuration therefore supports access operations, but it does not replace each application's access controls or recovery plan. NIST's digital identity model.