Fact-checked by Grok 2 weeks ago

Federated identity

Federated identity management is a process that enables the conveyance of identity and authentication information across a set of networked systems, allowing users to access resources from multiple organizations without creating separate accounts or credentials for each.^[1] This approach relies on established trust relationships between identity providers (IdPs), which authenticate users and manage their identities, and relying parties (RPs), which consume authentication assertions to authorize access to protected resources.^[2] In a federated identity scenario, a user authenticates once with an IdP, which then issues a secure assertion—such as a token or claim—detailing the user's verified identity and attributes; this assertion is presented to the RP, enabling seamless access without re-authentication.^[2] Common protocols supporting federation include Security Assertion Markup Language (SAML) for XML-based exchanges of authentication and authorization data, OpenID Connect (OIDC) built on OAuth 2.0 for web-based single sign-on, and others like Kerberos for enterprise environments.^[2] These standards ensure interoperability while incorporating security requirements, such as cryptographic signing and encryption of assertions, to meet defined assurance levels (e.g., Federation Assurance Levels FAL1 through FAL3).^[2] Federation simplifies credential management, reduces user friction through single sign-on (SSO), and enhances security by centralizing authentication at trusted IdPs rather than distributing credentials across systems.^[2] It is particularly valuable in cross-organizational contexts, such as government agencies or enterprise partnerships, where policies, standards, and processes allow acceptance of external digital identities and attributes for efficient interoperability.^[3] Privacy protections, including pairwise pseudonymous identifiers, are emphasized to minimize tracking and support user control over shared data.^[2]

Fundamentals

Definition and Principles

Federated identity is a system that enables users to access multiple applications and networks across different organizations using a single set of credentials managed by an external identity provider (IdP), thereby facilitating the reuse of digital identities beyond traditional organizational boundaries.^[4]^[5] This approach links a user's electronic identity and attributes stored in separate identity management systems, allowing secure interoperability without the need for redundant user accounts in each domain.^[6] At its core, federated identity operates on several foundational principles. Single sign-on (SSO) permits users to authenticate once with the IdP and gain seamless access to multiple service providers (SPs) without repeated logins, enhancing user experience while maintaining security.^[7]^[5] Attribute-based authorization involves the secure sharing of user attributes—such as roles, preferences, or group memberships—from the IdP to SPs, enabling fine-grained access decisions based on verified information rather than credentials alone.^[4]^[7] Decentralization of identity management further underpins this model by establishing trust relationships across domains, which reduces identity silos and eliminates the administrative burden of isolated credential stores within each organization.^[8]^[9] Federated identity distinctly contrasts with centralized identity management, such as that provided by LDAP in a single domain, where authentication and user data are confined to one authoritative directory service within an organization, limiting portability across boundaries.^[10] It also differs from local authentication, in which each application independently manages its own username-password pairs, requiring users to handle multiple credentials and increasing vulnerability to inconsistent security practices.^[7]^[4] In contrast, federated identity emphasizes cross-domain trust frameworks that delegate authentication externally while preserving control over authorization at the SP level.^[11] The basic workflow of federated identity begins when a user attempts to access an SP and is redirected to the IdP for authentication using their existing credentials.^[4] Upon successful verification, the IdP issues a security token or assertion containing the user's identity and relevant attributes, which the user presents to the SP.^[7] The SP validates the token against established trust and grants access without requiring re-authentication, streamlining the process across systems.^[5] This exchange typically relies on standardized protocols for secure token handling.^[11]

History and Evolution

The roots of federated identity can be traced to the late 1990s, when protocols like Kerberos began enabling cross-realm authentication within enterprise networks, allowing users to access resources across trusted domains without repeated credential entry.^[12] Developed initially at MIT in the 1980s, Kerberos version 5, standardized in 1993, incorporated cross-realm capabilities that gained practical adoption in distributed enterprise environments during the decade, laying foundational concepts for trust delegation between systems.^[13] A pivotal milestone occurred in September 2001 with the formation of the Liberty Alliance, a consortium of companies including Sun Microsystems, aimed at developing open standards for federated network identity management.^[14] This initiative developed the Identity Federation Framework (ID-FF), building on SAML 1.0, ratified by OASIS in November 2002, which provided an XML-based framework for exchanging authentication and authorization data across security domains.^[15] The Liberty Alliance later contributed enhancements that influenced SAML 2.0, ratified by OASIS in March 2005.^[16]^[17] Subsequent developments included Microsoft's release of WS-Federation version 1.0 in July 2003, extending WS-Trust to support federated identity in web services environments, followed by its Web SSO Interoperability Profile in 2005 for browser-based single sign-on. In December 2007, OpenID 2.0 was published by the OpenID Foundation, introducing a decentralized approach to user-centric identity verification without relying on a central authority. The landscape further evolved with OAuth 2.0, standardized by the IETF in October 2012 as RFC 6749 for secure authorization delegation, and OpenID Connect 1.0 in February 2014, which layered authentication atop OAuth to enable federated identity for web and mobile applications.^[18]^[19] The evolution of federated identity was driven in the 2010s by the proliferation of cloud computing and web services, which necessitated scalable mechanisms to move beyond siloed authentication systems toward seamless cross-organization access.^[20] This shift addressed the growing complexity of hybrid environments where users interacted with multiple service providers. In the 2020s, the rise of mobile devices and Internet of Things (IoT) ecosystems amplified demands for lightweight, scalable identity solutions capable of handling vast numbers of endpoints and transient connections.^[21] As of 2025, federated identity systems are increasingly integrated with zero-trust architectures, emphasizing continuous verification and micro-segmentation to enhance security in distributed networks.^[22] Concurrently, pilots for self-sovereign identity (SSI) frameworks, leveraging decentralized identifiers and verifiable credentials, are exploring extensions to traditional federation for greater user control over personal data.^[23] Adoption surveys indicate that over 75% of enterprises were utilizing multiple identity providers for federated access by 2024, reflecting widespread implementation amid rising cloud and remote work demands.^[24]

Core Components

Identity Providers and Service Providers

In federated identity management, the Identity Provider (IdP) serves as the trusted entity responsible for authenticating users and issuing digital credentials or assertions that confirm a user's identity and authentication status.^[25] The IdP maintains user identity information, verifies credentials such as usernames and passwords, and generates secure tokens or assertions that can be shared with other systems to enable access without requiring re-authentication. As of Revision 4 of NIST SP 800-63 (August 2025), IdPs may incorporate subscriber-controlled wallets for enhanced privacy and runtime attribute release. Common examples of IdPs include Microsoft Active Directory Federation Services (ADFS), which integrates with on-premises Active Directory for enterprise authentication; Okta, a cloud-based service for managing user identities across applications; and Google, which acts as an IdP for its user accounts in federated scenarios like single sign-on to third-party services.^[26]^[27] The Service Provider (SP), also known as the relying party, is the entity that relies on the IdP's assertions to grant users access to protected resources, applications, or services. The SP does not perform authentication itself but instead consumes the identity assertions provided by the IdP to make authorization decisions, such as permitting or denying access based on the user's verified identity and attributes.^[28] A key function of the SP is just-in-time (JIT) provisioning, where it automatically creates or updates user accounts dynamically upon the user's first successful authentication, using attributes from the IdP's assertion to populate necessary profile data without prior manual setup.^[29] The interaction between an IdP and SP is governed by federation agreements that establish mutual trust, outlining the terms under which identity information is shared. This relationship typically involves the exchange of metadata—such as entity descriptors containing configuration details like endpoints, public keys, and supported protocols—to facilitate discovery and secure communication between the parties.^[30] Through these agreements, the IdP and SP define the scope of data sharing, ensuring interoperability while maintaining security boundaries. Regarding responsibilities, the IdP handles primary authentication of users, adhering to established assurance levels, and enforces attribute release policies to control which identity information (e.g., email, roles) is disclosed to specific SPs, often with user consent mechanisms to protect privacy. For Federation Assurance Level 2 and above, IdPs require key protection meeting FIPS 140 Level 1 or higher.^[2] The SP, in turn, is responsible for validating received assertions—checking signatures, timestamps, and audience restrictions—and enforcing authorization logic based on the claims within them, such as mapping attributes to access roles or initiating JIT provisioning as needed.^[28] This division ensures that authentication remains centralized at the IdP while access control is decentralized at the SP, supporting scalable federated environments.

Trust Frameworks

Trust frameworks in federated identity management consist of structured sets of policies, technical standards, and legal agreements that govern secure interoperability between Identity Providers (IdPs) and Service Providers (SPs). These frameworks establish the foundational rules for sharing identity data across autonomous entities, ensuring that assertions about a user's identity are reliable and enforceable. According to NIST, trust frameworks underpin federated systems by combining operational, technical, and legal elements to bind participants to shared expectations of behavior and accountability.^[31] As updated in NIST SP 800-63-4 (August 2025), trust frameworks emphasize discrete steps for trust agreements and registration/discovery, often facilitated by federation authorities, and support subscriber-driven models including attribute bundles—signed collections of attributes issued by credential service providers for independent verification by SPs. Key components of trust frameworks include federation metadata, which typically takes the form of XML documents containing entity identifiers, service endpoints, public keys, and supported bindings for protocols like SAML. Certificate authorities play a critical role by issuing and managing X.509 certificates used to sign authentication assertions, verifying the integrity and origin of identity claims exchanged between parties. Additionally, attribute release consents ensure user privacy by requiring explicit or implicit approval before sensitive attributes, such as email or roles, are shared with SPs during federation transactions.^[32]^[2] Trust frameworks can be categorized as bilateral or multilateral. Bilateral frameworks involve pairwise agreements between a single IdP and SP, where trust is established directly through customized contracts and metadata exchanges, suitable for limited-scale integrations. In contrast, multilateral frameworks enable broader interoperability among multiple IdPs and SPs under a common set of rules managed by a federation operator, as seen in the InCommon Federation, which serves higher education institutions by facilitating secure access to shared research and academic resources. These frameworks often incorporate identity assurance levels (IALs) as defined in NIST SP 800-63, which specify the rigor of identity proofing processes (e.g., IAL1 for low-risk scenarios versus IAL2 for moderate-risk ones) to align trust with the sensitivity of the relying party's services.^[33]^[34] Maintaining trust frameworks requires ongoing processes such as periodic key rotation, where cryptographic keys in metadata are updated and republished to mitigate expiration or compromise risks, depending on the framework's policies. Auditing for compliance involves regular assessments of participants' adherence to baseline expectations, including reviews of incident response capabilities and attribute handling practices, often facilitated by the federation operator. Revocation mechanisms allow for swift termination of trust in cases of breach or non-compliance, such as removing an entity from metadata aggregates or invalidating certificates through certificate revocation lists (CRLs), ensuring the framework's integrity without disrupting legitimate operations.^[35]^[36]^[32]

Technologies and Standards

Key Protocols

Federated identity relies on several key protocols to enable secure exchange of authentication and authorization information across domains. These protocols define the structure, messaging, and flows for single sign-on (SSO), attribute sharing, and access delegation, ensuring interoperability between identity providers (IdPs) and service providers (SPs). Among the most prominent are SAML, OAuth 2.0, and OpenID Connect, each addressing specific aspects of identity federation while supporting broader ecosystems like WS-Federation and SCIM for specialized functions. Security Assertion Markup Language (SAML) is an XML-based open standard for exchanging authentication, authorization, and attribute information between parties, particularly for SSO and federated identity scenarios.^[37] Developed by the OASIS Security Services Technical Committee, SAML version 1.1 was ratified as an OASIS standard in September 2003, introducing core concepts for assertions and bindings.^[38] Version 2.0, approved in March 2005, enhanced federation capabilities with support for metadata, improved profiles for identity federation, and bindings such as HTTP POST, HTTP Redirect, and HTTP Artifact for message transport. SAML assertions contain statements about a subject's authentication status, attributes, or authorization decisions, enabling SPs to trust assertions issued by IdPs without direct user interaction.^[37] OAuth 2.0 serves as an authorization framework that allows third-party applications to obtain limited access to user resources on an HTTP service without sharing credentials, forming the foundation for many federated access scenarios.^[39] Published as RFC 6749 by the IETF in October 2012, it defines roles including resource owners, clients, authorization servers, and resource servers, along with grant types such as the authorization code flow, which involves redirecting users to an authorization endpoint for consent before issuing access tokens.^[39] Notably, OAuth 2.0 focuses on delegation of access rather than authentication itself, though it supports token-based mechanisms for secure resource access.^[39] Extensions like the Device Authorization Grant (RFC 8628, 2017) address input-constrained devices by using out-of-band verification codes for authorization. OpenID Connect (OIDC) builds upon OAuth 2.0 to provide an authentication layer, enabling clients to verify the identity of end-users and obtain basic profile information.^[40] Standardized by the OpenID Foundation in 2014, OIDC uses JSON Web Tokens (JWTs) as ID tokens to convey authenticated user claims, such as identity and attributes, in a structured, signed format.^[40] It extends OAuth 2.0 flows with discovery mechanisms for endpoint locations and supports discovery documents for dynamic client registration, making it suitable for web, mobile, and JavaScript clients in federated environments.^[40] The protocol's reliance on OAuth grants ensures compatibility while adding authentication-specific responses, like the ID token, to confirm user identity post-authorization.^[40] Other protocols complement these core standards in specific contexts. WS-Federation, an OASIS specification from 2009, facilitates federated identity in SOAP- and WS-*-based environments, particularly within Microsoft ecosystems like Active Directory Federation Services (ADFS), by defining passive and active requestor profiles for token issuance and security token services.^[41] For user provisioning across domains, the System for Cross-domain Identity Management (SCIM), defined in RFC 7644 (2015), provides an HTTP-based RESTful protocol using JSON schemas to automate the creation, update, and deletion of user identities between IdPs and SPs.^[42]

Implementation Technologies

Federated identity systems are implemented using a variety of open-source tools that provide robust support for identity providers (IdPs) and service providers (SPs). Shibboleth, an open-source software suite, serves as a primary implementation for SAML-based federated identity, enabling both IdP and SP functionalities to facilitate secure single sign-on across domains.^[43] Keycloak, another prominent open-source solution, excels in supporting OpenID Connect (OIDC) and OAuth 2.0 for federated authentication, allowing identity brokering with external IdPs without requiring application code changes.^[44] Gluu Server offers multi-protocol federation capabilities, integrating SAML 2.0, OIDC, OAuth 2.0, and other standards in a containerized open-source platform for comprehensive identity and access management.^[45] Commercial solutions dominate cloud-based deployments, providing scalable IdPs with seamless integration for federated identity. Okta, through its Auth0 platform, delivers cloud-native IdPs tailored for customer identity and access management (CIAM), supporting federation via SAML, OIDC, and social logins to streamline user authentication across applications.^[46] Ping Identity offers enterprise-grade tools for federated identity management, emphasizing support for SAML, OAuth, and OIDC protocols in hybrid environments to ensure secure access for workforce and customer use cases.^[47] Auth0, now integrated within Okta's ecosystem, focuses on developer-friendly CIAM solutions that enable rapid federation setup with minimal infrastructure overhead.^[48] Architectural patterns for federated identity deployment vary to accommodate different infrastructure needs. Proxy-based patterns utilize reverse proxies, such as Apache HTTP Server with the mod_auth_mellon module, to handle SAML authentication at the web server level, intercepting requests and validating assertions without altering application code.^[49] Embedded patterns incorporate software development kits (SDKs) directly into applications, allowing in-app handling of federated tokens for protocols like OIDC, which suits custom or microservices architectures. Cloud-native patterns leverage managed services like AWS Cognito for federation, enabling integration with external IdPs to issue temporary credentials and support scalable, serverless authentication flows.^[50] Deployment considerations emphasize scalability and flexibility, particularly for high-traffic environments as of 2025. Token caching mechanisms, such as in-memory or distributed caches integrated with tools like Keycloak or Okta, reduce latency by storing validated access tokens, supporting millions of concurrent users without repeated IdP queries.^[51] Hybrid on-premises and cloud setups have emerged as a key trend, combining on-prem IdPs like Shibboleth with cloud services such as AWS Cognito or Ping Identity to balance data sovereignty, performance, and cost in multi-cloud ecosystems.^[52]

Benefits and Challenges

Advantages

Federated identity management enhances user experience by enabling single sign-on (SSO), which allows individuals to authenticate once and access multiple services without repeated logins, thereby reducing password fatigue and the need to manage numerous credentials across domains.^[53]^[54] This consistent access streamlines interactions, minimizing disruptions and improving productivity for users in diverse environments.^[54] Additionally, centralized authentication through identity providers strengthens security by concentrating credential management and applying robust policies uniformly, rather than relying on disparate, potentially weaker per-service mechanisms.^[54]^[8] For organizations, federated identity reduces administrative overhead by eliminating the need for per-application user provisioning and maintenance, as identity providers handle authentication and attribute release on behalf of service providers.^[53] This automation leads to cost savings in identity and access management (IAM), with studies indicating reductions such as 30% in support efforts and up to 50% in password reset requests through decreased support needs.^[55]^[56] Federated identity promotes scalability and interoperability by allowing seamless integration across multi-vendor and cloud environments, facilitating business-to-business (B2B) partnerships without custom authentication integrations.^[57]^[58] It supports cloud migrations by enabling users authenticated by one provider to access resources from multiple relying parties, leveraging open standards like SAML and OpenID Connect for broad compatibility.^[53]^[59] In terms of compliance and risk reduction, federated identity enables centralized auditing of access events, aiding adherence to regulations such as GDPR and HIPAA through standardized attribute sharing and secure data handling.^[8]^[60] Just-in-time access provisioning further minimizes standing privileges by granting temporary permissions only when required, thereby lowering the risk of unauthorized exposure in federated ecosystems.^[61]^[62]

Security and Privacy Issues

Federated identity systems are susceptible to several key vulnerabilities that can compromise authentication and access control. Man-in-the-middle (MITM) attacks pose a significant risk during token transmission, where attackers intercept communications between the identity provider (IdP) and service provider (SP) to eavesdrop or alter assertions, potentially exposing sensitive user data or enabling unauthorized access.^[63] Token replay attacks occur when captured valid tokens are reused without re-authentication, exploiting the lack of replay protection in some protocols, while token forgery allows adversaries to create fraudulent assertions if signing mechanisms are weak or keys are compromised.^[63] Additionally, IdPs serve as single points of failure; a compromise can cascade across federated domains, as seen in the 2022 Lapsus$ breach of Okta, where attackers accessed support systems and potentially impacted downstream relying parties through stolen session tokens.^[64] Privacy concerns in federated identity primarily stem from attribute over-sharing, where IdPs disclose more user information than necessary to SPs, leading to unintended data leakage and enabling cross-domain tracking. This practice can violate regulations such as the California Consumer Privacy Act (CCPA), effective in 2020, which mandates explicit consent for personal data sharing and imposes penalties for excessive disclosure without user control. Tracking across domains further exacerbates these issues, as IdPs may log SP interactions to profile users, aggregating attributes like location or preferences without adequate anonymization.^[65] To mitigate these vulnerabilities and privacy risks, federated systems employ cryptographic protections such as signed and encrypted assertions; for instance, SAML uses XML signatures to verify assertion integrity and XML Encryption to protect confidentiality during transit. Implementing multi-factor authentication (MFA) at the IdP level adds a robust verification layer, blocking over 99% of account compromise attempts by requiring additional factors beyond passwords. Privacy-enhancing techniques like minimal disclosure further reduce risks by limiting shared attributes to only those essential for the transaction, often through pseudonymous identifiers or scoped claims in protocols like OAuth 2.0.^[66]^[63]^[67] In 2025, federated identity faces escalating challenges from AI-driven attacks, including sophisticated phishing and automated token manipulation, with 44% of leaders considering AI-driven phishing one of the top identity threats. Surveys indicate that 67% of organizations encounter security gaps due to interoperability issues in federated setups, such as inconsistent protocol implementations that amplify these risks across hybrid environments.^[68]^[69]

Applications and Examples

In consumer and social media applications, federated identity is prominently featured through social login mechanisms, allowing users to authenticate using credentials from established providers rather than creating new accounts. Common examples include "Sign in with Google," "Sign in with Facebook," and "Sign in with Apple," which enable seamless access to services like streaming platforms, news sites, and online forums. These implementations typically rely on protocols such as OAuth 2.0 for authorization and OpenID Connect (OIDC) for identity verification, facilitating secure token exchange without sharing passwords. Apple's "Sign in with Apple," introduced in June 2019, stands out for its emphasis on user privacy, offering features like randomized email addresses to prevent tracking by third-party apps and mandatory use of two-factor authentication. This approach addresses concerns over data sharing in social logins, providing an anonymous relay service that hides users' real email from service providers. Major social platforms have integrated federated identity to enhance user experience across networks. For instance, X (formerly Twitter) supports federation through OAuth 2.0, allowing users to log in to third-party apps and websites using their X credentials, which streamlines interactions like sharing posts or accessing premium content. Similarly, LinkedIn employs single sign-on (SSO) via OAuth 2.0 for its professional network, enabling members to authenticate into partner services for job applications or content collaboration without redundant logins. Adoption of social login in consumer applications is substantial, with one 2025 analysis of B2C enterprises showing it accounts for approximately one-third of all sign-in events, particularly on mobile devices where it represents nearly 38% of authentications. Google dominates these logins at over 90%, followed by Apple at about 9%. By 2025, social login has become a standard feature on the majority of consumer-facing websites, driven by its convenience in social and entertainment ecosystems.^[70] In e-commerce, social login accelerates onboarding, leading to higher conversion rates and lower cart abandonment. Studies indicate that adding social login options can boost sign-up conversions, with reports showing increases up to 40%.^[71] For music streaming, Spotify's federation with Facebook allows users to log in and share playlists directly, enhancing social discovery without separate account creation, a feature that has supported its growth to over 713 million monthly active users as of Q3 2025.^[72]^[73]

Enterprise and Government

In enterprise environments, federated identity enables seamless integration between cloud-based services and on-premises systems, allowing organizations to leverage existing identity infrastructures for secure access. For instance, Microsoft Entra ID (formerly Azure AD) supports federation with on-premises Active Directory through protocols like SAML and WS-Federation, facilitating single sign-on (SSO) to Office 365 applications while maintaining control over user authentication via Active Directory Federation Services (AD FS).^[74] This hybrid approach is particularly valuable for large enterprises transitioning to cloud productivity tools without disrupting legacy directory services.^[75] Similarly, Salesforce employs SAML 2.0 as a service provider to integrate with external identity providers, enabling users to access its CRM platform via SSO from corporate directories.^[76] This configuration simplifies user management for sales teams by delegating authentication to enterprise identity providers, reducing password fatigue and enhancing compliance with access policies. In business-to-business (B2B) scenarios, federated identity supports secure collaboration across organizational boundaries, such as in vendor portals where just-in-time (JIT) provisioning automates user account creation upon first authentication. For example, supply chain partners can use SSO via SAML or OpenID Connect to access shared portals for order tracking and inventory management, with JIT ensuring temporary roles are assigned without manual intervention.^[77] This approach minimizes administrative overhead while enforcing granular access controls based on partner attributes. Government applications of federated identity emphasize secure, cross-jurisdictional access to public services. In the United States, Login.gov serves as a centralized identity provider using SAML and OpenID Connect (OIDC) to authenticate users for over 50 federal agencies, streamlining logins for services like tax filing and benefits administration.^[78] In the European Union, the eIDAS Regulation (EU) No 910/2014 establishes a framework for mutual recognition of electronic identities, enabling cross-border digital signatures and authentication through federated trust networks that connect national identity schemes.^[79] This facilitates secure transactions, such as e-procurement or citizen services, across member states without requiring multiple credentials. Adoption of federated identity in enterprises has surged to support hybrid workforces, with 92% of Fortune 500 companies implementing such solutions by 2025 to manage distributed access securely.^[80]

Initiatives and Future Directions

Government Programs

In the United States, the Federal Identity, Credential, and Access Management (FICAM) program, led by the Federal Chief Information Officers (CIO) Council and managed by the General Services Administration (GSA), provides a government-wide framework for implementing identity, credential, and access management (ICAM) solutions to secure federal resources. The FICAM roadmap, originally established in 2011, was updated through the 2023 ICAM Reference Architecture developed in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), emphasizing scalable federation protocols like SAML and OAuth to enable secure cross-agency identity sharing. This update aligns FICAM with the 2021 Federal Zero Trust Strategy issued by the Office of Management and Budget (OMB), which mandates identity verification as a core pillar of zero trust architectures to eliminate implicit trust in network access and enhance continuous authentication for federal applications.^[81]^[82] In the European Union, the eIDAS 2.0 regulation, formally Regulation (EU) 2024/1183 adopted on 26 March 2024, published on 30 April 2024, and entering into force on 20 May 2024, builds on the original 2014 eIDAS framework by expanding electronic identification to include decentralized digital identity wallets, facilitating cross-border federated authentication for public and private services. This regulation requires member states to offer European Digital Identity Wallets (EUDI Wallets) by 2026, supporting attribute-based credentials and interoperable federation standards such as OpenID Connect to enable seamless identity verification across EU borders while maintaining user control over personal data. eIDAS 2.0 promotes federation by establishing a trust framework for qualified electronic attestations, allowing citizens to reuse verified identities for services like banking and healthcare without redundant proofs.^[79]^[83] Australia's myGovID, launched in 2018 by the Australian Taxation Office as part of the Australian Government Digital ID System (AGDIS), serves as a federated digital identity solution for accessing over 1,000 citizen services across federal agencies, using standards like NIST identity assurance levels to verify and share attributes securely. Renamed myID on 13 November 2024, it enables single sign-on federation with state and territory services, reducing credential fatigue while adhering to privacy principles under the Privacy Act 1988. Similarly, Canada's Government of Canada (GC) Identity, Credential, and Access Management (ICAM) Framework, outlined in the 2022 Treasury Board of Canada Secretariat directive, implements federated identity management for GC applications through protocols like SAML 2.0, allowing secure attribute exchange between federal departments and external partners to support services such as tax filing and benefits administration.^[84]^[85]^[86] On the global scale, the ISO/IEC 24760 series provides an international standard for identity management frameworks, with the 2025 edition of ISO/IEC 24760-1, published in September 2025, updating terminology and core concepts to emphasize interoperability in federated systems, including lifecycle management of digital identities across domains. This standard supports secure federation by defining requirements for identity providers and relying parties, influencing government implementations worldwide. In parallel, United Nations initiatives through the Digital Public Goods Alliance and UNDP's digital public infrastructure (DPI) efforts highlight priorities for interoperability standards in identity systems as part of broader digital public goods, aiming to enable cross-border data sharing in sustainable development contexts while addressing challenges like privacy in adoption.^[87]

Emerging Trends

Self-sovereign identity (SSI) represents a paradigm shift toward decentralized digital identity models, where individuals maintain control over their personal data without depending on centralized identity providers (IdPs). This approach leverages blockchain technology and decentralized identifiers (DIDs) to enable verifiable credentials that users can selectively disclose, reducing the risks associated with federated systems' reliance on trusted intermediaries. The W3C DID standard, finalized in 2022, provides a foundational framework for these interoperable, self-managed identifiers, allowing entities to create and resolve DIDs on distributed ledgers without central authority.^[88] Emerging implementations, such as those in the Sovrin network, demonstrate high compliance with SSI principles like user control and portability, using federated blockchain governance to ensure scalability and security.^[89] As of 2025, the global SSI market is valued at USD 3.49 billion, with projections indicating significant growth to USD 1,153.07 billion by 2034, driven by blockchain incorporation for enhanced autonomy in privacy-focused ecosystems beyond traditional federation.^[90] Integration of artificial intelligence (AI) and machine learning (ML) into federated identity systems is driving adaptive authentication mechanisms that dynamically assess risk based on user behavior and context. These technologies enable real-time anomaly detection, such as identifying unusual login patterns or device anomalies, by analyzing historical data to establish behavioral baselines. In federated environments, AI enhances cross-domain trust decisions, allowing systems to predict and mitigate threats without disrupting legitimate access. By 2025, AI and ML are anticipated to form the core foundation of identity and access management (IAM) platforms, shifting from supplementary features to essential components for countering sophisticated attacks at machine speed.^[91] Passwordless authentication is advancing through extensions to FIDO2 and WebAuthn standards, facilitating phishing-resistant single sign-on (SSO) across federated domains. These protocols use public-key cryptography and device-bound credentials, often tied to biometrics like fingerprint or facial recognition, to eliminate shared secrets and verify user intent directly at the relying party. In federated setups, passkeys—synced cryptographic keys managed by providers—enable seamless, cross-device SSO without exposing users to phishing, as authentication is bound to specific origins. The FIDO Alliance's passkey ecosystem supports this by promoting interoperability, with adoption as of May 2025 showing 69% of consumers enabling passkeys on at least one account for enhanced security and convenience.^[92]^[93] The broader federated identity ecosystem is converging with edge computing to support Internet of Things (IoT) applications, enabling distributed authentication at the network periphery for low-latency, resilient access control. This integration allows IoT devices to participate in federated trust models via local policy enforcement and behavioral analytics, minimizing central server dependencies. Addressing future threats, IAM systems are incorporating quantum-resistant cryptography, such as hybrid post-quantum algorithms like CRYSTALS-Kyber, to safeguard long-lived credentials against quantum attacks. In 2025, these developments are expected to emphasize zero-trust architectures and AI-driven lifecycle management for IoT identities, ensuring scalability in edge-deployed environments.^[94]^[95]

References

[1]
Federated Identity Management - Glossary | CSRC
A process that allows for the conveyance of identity and authentication information across a set of networked systems.
[2]
NIST Special Publication 800-63C - NIST Pages
In a federated identity scenario, the subscriber does not authenticate directly to the RP. Instead, the federation protocol defines a mechanism for an IdP to ...
[3]
FICAM Architecture - IDManagement.gov
Federation is the technology, policies, standards, and processes that allow an agency to accept digital identities, attributes, and credentials managed by other ...
[4]
What Is Federated Identity? | Okta
Aug 19, 2024 · Federated identity is a method of linking a user's identity across multiple separate identity management systems.
[5]
What is Federated Identity Management (FIM)? How Does It Work?
Feb 27, 2025 · FIM is an arrangement between multiple enterprises or domains that enables their users to use the same identification data (digital identity) to access all ...
[6]
What Is Federated Identity? How It Works & Why - 1Kosmos
Jul 21, 2023 · Federated identity refers to linking a person's electronic identity and attributes stored across multiple identity management systems.
[7]
Federated Identity pattern - Azure Architecture Center | Microsoft Learn
Federated authentication provides a standards-based solution to the issue of trusting identities across diverse domains, and can support single sign-on.
[8]
What is Federated Identity Management (FIM)? - SecurEnds
Feb 28, 2025 · With fewer authentication silos, organizations minimize security vulnerabilities associated with fragmented identity management. Scalability.<|control11|><|separator|>
[9]
What is Identity Federation?
Sep 27, 2022 · Identity federation is a decentralized approach to authentication that allows users to access multiple online services with a single set of credentials.
[10]
LDAP, Active Directory and Federated Identity
May 20, 2020 · Active Directory Federation Services (AD FS) is a part of Active Directory (AD), an identity directory service for users, workstations, and applications.
[11]
Understanding federated identity | Network World
Federated identity management refers to the agreements, standards and technologies that enable the portability of identities, identity attributes and ...
[12]
An Exploration of Open Identity Standards - Okta
Oct 31, 2022 · In the realm of federated identity, several transitions were underway. Kerberos and LDAP emerged in the 1990s as tools to authenticate users and ...
[13]
RFC 1510 - The Kerberos Network Authentication Service (V5)
Cross-Realm Operation The Kerberos protocol is designed to operate across organizational boundaries. A client in one organization can be authenticated to a ...
[14]
[PDF] Liberty Alliance Project - 3GPP
What is the Liberty. Alliance ? •. A business alliance, formed in Sept 2001 with the goal of establishing an open standard for federated identity management.Missing: precursor | Show results with:precursor
[15]
Security Assertion Markup Language (SAML) Ratified as OASIS ...
Nov 5, 2002 · Security Assertion Markup Language (SAML) Ratified as OASIS Open Standard. 5 Nov 2002. Authentication and Authorization Standard Enables Single ...
[16]
RFC 6749 - The OAuth 2.0 Authorization Framework
The OAuth 2.0 Authorization Framework (RFC 6749, October 2012)Email expansions for rfc6749 · History for rfc6749 · RFC 8252
[17]
Final: OpenID Connect Core 1.0
Feb 25, 2014 · OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It enables Clients to verify the identity of the End-User.
[18]
From federation to fabric: IAM's evolution - IBM
We will explore how identity and access interoperability have evolved from federation standards and protocols until now and how this is evolving forward.Missing: Kerberos | Show results with:Kerberos
[19]
Cloud-based federated identity for the Internet of Things
Aug 1, 2018 · We outline a proposed model for IoT that allows the identity of users and devices to be federated. Users and devices are issued with secure, ...
[20]
(PDF) Integrating Zero Trust Architectures and Blockchain Protocols ...
Aug 11, 2025 · This article explores the convergence of ZTA and blockchain technologies as a transformative strategy for enhancing the confidentiality, ...
[21]
Self-Sovereign Identity: The Ultimate Guide 2025 - Dock Labs
Oct 31, 2025 · Self-Sovereign Identity (SSI) is a model that gives individuals full ownership and control of their digital identities without relying on a third party.
[22]
According to Cloud Security Alliance Survey More than Half of | CSA
Oct 30, 2024 · Report also found that over 75% of enterprises are using two or more IDPs and struggle to manage access controls and consistent security ...Missing: rate | Show results with:rate
[23]
Identity Provider (IdP) - Glossary | CSRC
A trusted entity that issues or registers subscriber authenticators and issues electronic credentials to subscribers.
[24]
Set up AD FS federation - Microsoft Entra External ID
Apr 9, 2025 · This article describes how to set up SAML/WS-Fed IdP federation using Active Directory Federation Services (AD FS) as either a SAML 2.0 or WS-Fed IdP.
[25]
Identity Providers (IdPs): What They Are and Why You Need One
Oct 30, 2024 · An Identity Provider (IdP) is a system that authenticates users' identities and authorizes their access to various applications and services.
[26]
Federation – Amazon Web Services (AWS)
After authenticating a user, the IdP sends the SP a message, called an assertion, containing the user's sign-in name and other attributes that the SP needs to ...
[27]
Configuring just-in-time provisioning - Ping Identity Docs
PingFederate's just-in-time (JIT) provisioning allows service providers (SPs) to create user accounts on the fly during single sign-on (SSO) events.
[28]
[PDF] Digital Identity Guidelines: Federation and Assertions
Jul 24, 2025 · This guideline focuses on the use of federated identity and the use of assertions to implement identity federations. Federation allows a given ...
[29]
Introduction to Identity Attributes and Attribute Release for Access to ...
The IdP is always in control of what attributes are released to an individual SP, and has a responsibility to limit attribute release and protect the users ...
[30]
[PDF] Developing Trust Frameworks to Support Identity Federations
Trust frameworks present the operational and technical requirements for federated identity management, and must also provide the legal basis to bind those ...
[31]
[PDF] Metadata for the OASIS Security Assertion Markup Language (SAML ...
Mar 15, 2005 · Abstract: SAML profiles require agreements between system entities regarding identifiers, binding support and endpoints, certificates and keys, ...
[32]
[PDF] Digital Identity Guidelines: Federation and Assertions
The authorized party in a trust agreement is the organization, person, or entity that is responsible for the specific release decisions covered by the trust ...
[33]
[PDF] Federation Simplified (v2) - IDPro Body of Knowledge
Apr 19, 2021 · Bilateral Federation A bilateral federation is one that consists of only two entities: one. Identity Provider (IdP) and one Service Provider (SP) ...
[34]
Trusted Relationships for Access Management - InCommon
The federation provides a common, agreed-on framework to ensure trust and operational efficiencies at scale. This framework includes establishing standards for ...Missing: components authorities
[35]
Processes to Maintain Baseline Expectations - InCommon
InCommon's Baseline Expectations ensure trustworthiness through consensus, dispute resolution, metadata maintenance, and accountability.1. Introduction · 4. Ongoing Federation... · 5. ReinstatementMissing: auditing compliance key rotation revocation
[36]
Baseline Expectations for Trust in Federation - InCommon
This document describes the expectations for each of the three types of Federation actors: Identity Provider, Service Provider, and Federation Operator.Introduction · Appendices · Appendix A: ReferencesMissing: auditing compliance
[37]
[PDF] saml-core-2.0-os.pdf - Index of /
Mar 15, 2005 · This specification defines the syntax and semantics for XML-encoded assertions about authentication, attributes, and authorization, and for the ...
[38]
Security Assertion Markup Language (SAML) v1.1 [OASIS 200308]
Security Assertion Markup Language (SAML) v1.1 [OASIS 200308]. Approved: 01 Sep 2003. Defines the syntax and semantics for XML-encoded assertions about
[39]
RFC 6749 - The OAuth 2.0 Authorization Framework
The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner.Oauth · RFC 5849 · RFC 9700 · RFC 8252
[40]
OpenID Connect Core 1.0 incorporating errata set 2
Dec 15, 2023 · OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It enables Clients to verify the identity of the End-User.
[41]
ws-federation-1.2-spec-os.html - Index of /
This includes a discussion of the federation goals and issues, different trust topologies, identity mapping, and the components of the federation framework.
[42]
RFC 7644 - System for Cross-domain Identity Management: Protocol
The System for Cross-domain Identity Management (SCIM) specification is an HTTP-based protocol that makes managing identities in multi-domain scenarios easier ...
[43]
Shibboleth Consortium - Shaping the future of Shibboleth Software
With open-source solutions suitable for organisations of all sizes, Shibboleth is among the most widely deployed identity management software in the world.The Shibboleth Project · Products · Shibboleth Support · Learn about the ConsortiumMissing: SAML | Show results with:SAML
[44]
Keycloak
Keycloak - the open source identity and access management solution. Add single-sign-on and authentication to applications and secure services with minimum ...Documentation 26.4.4 · Downloads · Keycloak 26.2.5 released · Guides
[45]
Gluu Server 4.1 Docs
### Summary of Gluu Server 4.1 as a Multi-Protocol Federation Open-Source Tool
[46]
Auth0 Platform - Okta
Auth0 is your developer-friendly platform for Customer Identity. It simplifies authentication and authorization so you can build secure apps and experiences.
[47]
Okta vs. Ping: The Best IAM for Digital Security - Ping Identity
May 3, 2024 · Ping has better IGA, fraud prevention, and a unified platform, while Okta has basic IGA and separated solutions. Ping also has better ...Missing: commercial | Show results with:commercial
[48]
Better Identity Management for Your Organization - Auth0
Federated Identity Made Easy. Instant identity integration with your existing Active Directory, Ping, SAML, and other identity providers with the flip of a ...Missing: commercial | Show results with:commercial
[49]
Configuring the mod_auth_mellon Apache Module - Keycloak
The mod_auth_mellon is an authentication module for Apache. If your language/environment supports using Apache HTTPD as a proxy, then you can use mod_auth_ ...Missing: federated architectural patterns embedded AWS Cognito
[50]
User pool sign-in with third party identity providers - Amazon Cognito
Your app users can either sign in directly through a user pool, or they can federate through a third-party identity provider (IdP).Configuring identity providers... · Linking federated users · Mapping IdP attributesMissing: proxy- embedded cloud- native Apache mod_auth_mellon
[51]
https://www.keycloak.org/docs/latest/server_admin/index.html
[52]
Workload Identity Brokering: Securing Non-Human Access in the ...
Jun 19, 2025 · Hybrid Deployment: Organizations with both on-premises and cloud resources can use a hybrid approach. This often involves federating an on- ...
[53]
[PDF] Background on Identity Federation - Technologies for the Public Safety
Jun 9, 2021 · OpenID Connect is a profile of OAuth 2.0 tailored to provide federated ... OAuth can be used in conjunction with both SAML and OpenID Connect.
[54]
What is federated identity? - Article - SailPoint
Apr 27, 2023 · See how federated identity mitigates password fatigue, streamlines access for users, and simplifies password management for IT teams.<|separator|>
[55]
Identity and Access Management Trends for 2025 - Veritis
In 2025, IAM researchers and vendors will concentrate more on new directions and security postures to improve IAM implementation.
[56]
[PDF] The Role of Identity and Access Management (IAM) in Modern ...
Jun 4, 2025 · Organizations implementing mature IAM programs report operational cost reductions averaging 35% through automated provisioning and.
[57]
Integral Federated Identity Management for Cloud Computing
May 31, 2012 · The proposed architecture offers significant advantages over current offerings: it eases identity management without losing flexibility ...
[58]
Federated Identity Providers: A Comprehensive Guide - LoginRadius
Mar 26, 2021 · Interoperability: Federated identity allows for interoperability between different systems and domains. This enables organizations to ...
[59]
(PDF) Federated Identity Management and Interoperability for ...
PDF | This paper describes an approach to overcome the interoperability challenges related to identity management systems supporting cross-collaboration.Missing: B2B | Show results with:B2B
[60]
IAM Using SSO and Federated Identity Management - Akku
Sep 2, 2025 · It makes scaling easier, supports compliance with regulations like GDPR and HIPAA, and ensures employees can access the tools they need without ...<|separator|>
[61]
[PDF] Identity and Access Management: Recommended Best Practices for ...
Mar 21, 2023 · For any required and authorized local accounts/identities, define a password policy, and auditing to ensure compliance. • Define a policy ...Missing: rotation | Show results with:rotation
[62]
[PDF] Hybrid Identity Solutions Architecture - CISA
ensuring that the right users are granted just enough access to the right resources, just in time, and for the right purpose. No one identity solution is ...
[63]
SAML Security - OWASP Cheat Sheet Series
Their SSO profile was vulnerable to a Man-in-the-middle attack from a malicious SP (Service Provider). The SSO Web Browser Profile is most susceptible to ...
[64]
Lessons From Okta's Security Breach - Doppler
Oct 26, 2023 · The Okta breach manifests the critical importance of stringent security protocols and the indelible impact a single point of failure can have on ...Tl;Dr · Timeline Of Events · How To Avoid A Data Breach...Missing: federated example
[65]
Privacy - NIST Pages - National Institute of Standards and Technology
Other processing of attributes may carry different privacy risks that call for obtaining consent or allowing subscribers more control over the use or disclosure ...
[66]
Plan for mandatory Microsoft Entra multifactor authentication (MFA)
Sep 23, 2025 · Research by Microsoft shows that MFA can block more than 99.2% of account compromise attacks. That's why, starting in 2024, we'll enforce ...
[67]
Research insights: 4 trends reshaping identity security in 2025
Aug 26, 2025 · AI-driven phishing is one of the top identity threats for 2025 according to 44% of leaders, alongside insider threats and supply chain attacks.
[68]
[PDF] Understanding federated identity management: Architecture ...
Jun 5, 2025 · Adoption statistics indicate that broker-based implementations have grown significantly in recent years, now representing approximately 25% of ...
[69]
Social Login: Definition, Pros & Cons, Examples - Descope
Apr 25, 2025 · Social login adoption grew from 10% to 29% in just two months. Traditional password use dropped from 42% to 26%. That's a 190% increase in ...What is social login? · Social login vs. SSO · Why use social login for your app
[70]
How to Use Social Login to Drive Your App's Growth - Auth0
Increase Your Sign Up Conversion Rate by 20% · “40-60% increase in conversion rates with some reaching upwards of 130%” · “Conversion rates increase anywhere from ...Missing: statistics | Show results with:statistics
[71]
Logging in to Spotify with Facebook
You can add Facebook as a login method from your account page. Once added, you can use Facebook to log in to your Spotify account. Can't log in with Facebook?
[72]
What is federation with Microsoft Entra ID?
Apr 9, 2025 · This method allows administrators to implement more rigorous levels of access control. Federation with AD FS and PingFederate is available.
[73]
Integrate On-Premises Active Directory Domains With Microsoft ...
Learn how to implement a secure hybrid network architecture that integrates on-premises Active Directory domains with Microsoft Entra ID.
[74]
SAML SSO with Salesforce as the Service Provider
SAML is an open-standard authentication protocol that Salesforce uses for single sign-on (SSO) into a Salesforce org from a third-party identity provider.
[75]
What is Partner IAM? Secure B2B Access Explained - LoginRadius
Jun 19, 2025 · Learn how Partner/ B2B IAM enables secure, scalable access for vendors, agencies, and partners with SSO, JIT provisioning, and granular role ...
[76]
Simple, secure online access for the public - Login.gov
Your application(s) can integrate with the SAML or OpenID Connect (OIDC) web-based identity protocols; You are looking for a highly secure (FedRAMP Moderate) ...Our services · Business inquiries · Get started · Roadmap
[77]
eIDAS Regulation | Shaping Europe's digital future
May 5, 2025 · The eIDAS regulation facilitates secure cross-border transactions by establishing a framework for digital identity and authentication.Missing: federated | Show results with:federated
[78]
Why Your Board Should Invest in SAML Federation - Avatier
Aug 17, 2025 · 92% of Fortune 500 companies have implemented federated identity solutions. Organizations without modern authentication standards experience 46 ...
[79]
Federal identity, credential, and access management - GSA
Aug 18, 2025 · FICAM is the governmentwide approach to implementing the tools, policies, and systems that an agency uses to manage, monitor, and secure access to protected ...Missing: CIO | Show results with:CIO
[80]
[PDF] Identity, Credential, and Access Management (ICAM) Reference ...
Sep 12, 2023 · An overview of the FICAM architecture, a collaboration between the General Services Administration (GSA) and the Federal Chief Information ...
[81]
myGovID is now called myID - Australian Taxation Office
Nov 13, 2024 · The Australian Government's Digital ID app myGovID is now called myID. The updated app is being rolled out in app stores from 13–17 November 2024.
[82]
[PDF] Government of Canada Identity, Credential and Access ...
Jan 28, 2022 · Federation Management. Page 22. GC Identity, Credential, and Access Management (ICAM) Framework. UNCLASSIFIED. 19 external and internal entities ...
[83]
Directive on Identity Management- Canada.ca
Ensures effective identity management practices by outlining requirements to support departments in the establishment, use and validation of identity ...
[84]
Digital public infrastructure | United Nations Development Programme
By fostering safe, fair and interoperable digital systems, UNDP helps countries accelerate their progress towards the Sustainable Development Goals, with DPI ...
[85]
https://canada-ca.github.io/gc-icam_gija-gc/docs/icam_framework-en.pdf
[86]
Self-sovereign identity on the blockchain: contextual analysis and ...
Aug 29, 2024 · This study contextualizes SSI and analyzes how blockchain technology facilitates the autonomous management of digital identities.
[87]
Self-Sovereign Identity from innovation to market - Eviden
By 2025, 20% of digital IDs will leverage blockchain. Self-sovereign identities (SSI) should revolutionize security and digital identity.
[88]
13 Latest Trends in Identity and Access Management [2025]
Aug 25, 2025 · The IAM landscape in 2025 and beyond is defined by rising threats, AI-powered attacks, and an explosion of human and machine identities.Missing: savings | Show results with:savings
[89]
Passkeys: Passwordless Authentication - FIDO Alliance
Explore passkeys and how they provide phishing-resistant, passwordless login with faster sign-in and enhanced security. Start your passkey implementation.
[90]
2025 Trends in IoT Device Identity and Access Management (IAM)
Identity and access management (IAM) plays a pivotal role in IoT security by managing digital identities and controlling access to devices and networks.Missing: resistant | Show results with:resistant
[91]
An AI-Driven Framework for Integrated Security and Privacy ... - MDPI
The framework addresses various aspects of IoT security, including identity and access management, quantum-resistant cryptography, edge-centric security, and ...