Federated identity lets users access multiple applications or services with one set of login credentials, even across different organizations. This works through an Identity Provider (IdP), which manages and verifies user identities.
When a user logs in, the IdP confirms their identity and shares that information with other trusted services, so users don’t need separate usernames and passwords for each one. This makes logging in easier for users and reduces the burden on businesses to manage multiple accounts, while also improving security.
What is Federated Identity / Identity Federation?
Identity federation delegates user authentication to an external, trusted partner called a Federated Identity Provider (IdP). The service or application (Service Provider) relies on the IdP to verify the user's identity, allowing access without handling authentication directly.
This approach streamlines user experience-users log in once and use the same credentials across multiple services-and enhances security by reducing the number of passwords to manage.
In corporate settings, Active Directory (AD) manages internal authentication, while Active Directory Federation Services (ADFS) enables federation with external services. Online, providers like Google Account, Azure AD, or cloud-based solutions such as 10Duke serve as IdPs. Regardless of the provider, the IdP authenticates users stored in its database.
Example of Federated Identity
Suppose you sell a web app, 'DesignX', to a corporate client, 'GlobalCo'. Without federated identity, GlobalCo employees must log in to their corporate network and then log in again to DesignX-two sets of credentials, which is inconvenient and less secure.
Federated identity management solves this by connecting the two identity providers (e.g., Active Directory for GlobalCo and 10Duke IdP for DesignX). Through federation, 10Duke delegates authentication to Active Directory (via ADFS), trusting AD to verify the employee. The employee accesses DesignX without re-entering credentials.
Terms like 'ID federation', 'federated identity', and 'federated identity management' all refer to this process.
Benefits of Federated Identity Management
Federated identity management improves security and streamlines login, boosting productivity. In our example, a single, secure database (AD) manages credentials. If an employee leaves and is removed from AD, they lose access to DesignX automatically.
This approach saves time, especially if employees use many applications. Instead of remembering multiple passwords (which often leads to insecure practices), users have one strong password for all services.
You might wonder-isn’t this just Single Sign-On (SSO)?
Federated Identity Management vs. SSO
Federated Identity Management (FIM) and Single Sign-On (SSO) are related but distinct. SSO lets users access multiple services within one organization using a single login. FIM, however, extends this to multiple organizations, connecting different identity systems based on mutual trust. FIM enables SSO across organizations, but SSO alone doesn’t provide federation.
For example, logging into Airbnb with your Facebook account demonstrates FIM, as Facebook and Airbnb are separate systems. Using your Google account for Gmail and Google Maps is SSO within one organization. Using your Google account to access Quora, however, is FIM. The user experience is seamless, so the distinction often goes unnoticed.
Identity Federation and SAML SSO
“Federation” is often called “SAML SSO.” When a company supports SAML SSO, it usually means it supports identity federation using the SAML 2 standard to authenticate and share user information for SSO. In practice, a user with a SAML 2-based identity can access multiple apps with one login, making “SAML SSO” and “federated identity” effectively synonymous in this context.
Why Consider Identity Federation?
Identity federation is a strong selling point for application vendors, especially with large customers who have strict security needs. Supporting federation reassures customers that their authentication methods remain consistent and secure across applications. It’s a simple yet powerful feature-one that the 10Duke Enterprise supports.
We get a lot of questions from partners regarding ‘federated identity’ or ‘identity federation’, so we thought we’d do a short summary to explain what it is and how you can use it to help your users and your business.