What it means
Common designs use standards such as SAML, OAuth, and OpenID Connect. Security depends on trust configuration, token validation, signing keys, redirect handling, session control, and the identity provider's resilience.
Why it matters
Centralized authentication can improve control and user experience, but compromise of the identity provider can affect many services at once.
Practical focus
- Validate issuer, audience, signature, and token lifetime
- Protect federation keys and administrative changes
- Use conditional access and strong authentication
- Plan for identity-provider outage and compromise
Common mistakes
- Treating OAuth as an authentication protocol by itself
- Accepting tokens without full validation
- Leaving old trust relationships active
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: