What Is Federated Identity?

Topics

Cybersecurity, IAM

TL;DR

Federated identity links a user's digital identity across multiple platforms, enabling seamless movement between systems without repeated logins. Built on protocols like Security Assertion Markup Language (SAML), Open Authorization (OAuth), and OpenID, it operates under seven core principles — from user consent to data minimization — that balance convenience with security. Adopted by major organizations, federated identity reduces costs, improves efficiency, and strengthens data protection compared to managing separate credentials for every system.

What is federated identity?

Federated identity is a method of linking a user's identity across multiple separate identity management systems. It allows users to quickly move between systems while maintaining security.

How does federated identity build on single sign-on?

The average employee has 191 passwords to track, perfect, and update. Those same employees have crucial work to do, families to run, and finances to protect. Reusing passwords seem harmless or even helpful. But doing so can lead to immense security risks.

Enter single sign-on (SSO) techniques. With one form of identity verified, the user can move from system to system without logging in to each one.

How does federated identity extend beyond SSO?

Federated identity management supports SSO, but it takes the concept of signing a bit further.

Companies that invest in federated identity solutions agree on a set of shared principals. That ensures quick movement between systems without compromising security.

What is the relationship between federated identity and authentication?

Your digital identity is made up of attributes that define you as a unique person moving through the landscape. Federated identity is an agreement between entities about the definition and use of those attributes. Agreements allow you to sign on in one place and then jump to another asset without signing in again.

Identity federation is a generic term, and it can apply to many different types of companies, platforms, and protocols. But those that offer identity federation products agree to use technology others understand and can access. That way, different platforms can communicate and share without requiring another login.

What are the seven laws of identity?

Seven so-called "laws of identity" sit beneath federated identity systems.

User control and consent: Users give permission to share data, and they have at least some say in how shares happen.
Minimal disclosure: The smallest amount of identifying information is shared, and it's stored securely and deleted quickly.
Justification: Only those who can prove they need access can get it.
Directed identity: Protection of identity is paramount, and users should be assigned private identifiers for that purpose. Companies can't work together to build a more permanent view of someone working across platforms.
Competition: Many identity providers should be supported, as competition breeds better performance.
Human integration: A real person has a place in the process, reducing the risk of computer-to-computer hacks.
Consistency: The users have a simple, consistent experience among platforms.

Read through these concepts carefully, and a picture of federated identity begins to form. And chances are, every modern user has encountered the process at least once. If you've logged into Google and then dashed to another website for protected info without another login, you've encountered federated identity concepts.

How does federated authentication work?

Federated identity management relies on strong agreements. Identity providers and service providers develop an understanding of what attributes (such as your location or phone number) are representative of who you are online. Once those credentials are verified, you're authenticated across multiple platforms.

What technologies power federated identity management?

Common technologies used in federated identity management include:

Security Assertion Markup Language (SAML): An XML-based standard for exchanging authentication data between identity and service providers.
OAuth: An open standard for access delegation, commonly used to grant websites or applications limited access to user information.
OpenID: An open standard for decentralized authentication, allowing users to be authenticated by cooperating sites using a third-party identity provider.

Companies might use security tokens, such as JSON Web Token (JWT) tokens and SAML assertions, to pass permissions from one platform to another.

How does Google's OAuth process work step by step?

Consider Google's federated identity process with OAuth. To use this system, developers must:

Pull OAuth credentials from Google's Application Programming Interface (API). Choose data, such as a client ID and client secret, that both Google and your company know.
Grab an access token from the Google Authorization Server. Users will need a token from Google to complete web requests for access.
Compare the access scopes. Users grant access to data, and you must compare that your request matches their willingness to share.
Send the token to an API. Users are ready to gain access, as long as the token is included in a Hypertext Transfer Protocol (HTTP) authorization request header.

To a user, the process is almost invisible. They come to a website they'd like to enter, and they're shown a screen asking them to log in via other credentials. They hit a button or two, and access magically appears.

What role does the government play in identity federation?

Computer developers think of themselves as autonomous entities, free of politics and interference. In reality, the government is deeply interested in how federated identity works and who is in charge of it.

That interest stems from Homeland Security Presidential Directive 12, issued in 2004. Here, experts required secure credentials to access government assets, and teams were encouraged to build systems that allowed for quick movement between platforms and programs. Speed was crucial, but safety was needed.

Since 2004, plenty of companies have developed agreements, protocols, and programs for federated identity. But more work is required.

What is the current state of government-led identity federation standards?

Currently, the National Cybersecurity Center of Excellence and the National Strategy for Trusted Identities in Cyberspace National Program Office are collaborating on a Privacy-Enhanced Identity Federation project. When complete, the team will release a set of standards companies can use for federated identity. No release date is available quite yet.

What are the benefits of federated access?

Some companies allow secure sign-on without touching federated identity concepts at all. Others wouldn't dream of running a product this way. Which side is right?

The benefits of federated identity include:

Lower cost. Use federated products, and you won't need to build your own SSO solutions.
Enhanced efficiency. Employees won't need to waste time logging into systems over and over again.
Protected data. Federated solutions come with an enhanced expectation of data protection and security. And since each login is a point of vulnerability for companies, streamlining the process could reduce hacking risks.

Dimension	Federated Identity	Traditional Credential Management
Cost	Lower — no need to build custom SSO solutions	Higher — requires building and maintaining separate credential systems
Security	Stronger — fewer individual login points reduce vulnerability	Weaker — each separate login is a potential point of vulnerability
User Experience	Seamless — users authenticate once and move between systems	Friction-heavy — users must log in repeatedly across systems

What are common misconceptions about federated access?

There aren't significant drawbacks to using federated access, but there are some common misconceptions about it. These include:

Less control. Federated identity management solutions follow a specific set of rules and agreements. Some people fear this means less control, but this isn't the case. SSO vendors usually provide various configuration options so systems can behave as needed.
Potential security risks. No authentication protocol is entirely secure, and some federated programs come with known vulnerabilities. Generally, a federated program built to typical standards is more secure than almost any other program.

Plenty of companies consumers know and trust use federated identity concepts, including Google, Facebook, and Yahoo. If these organizations lean on the concepts, it's realistic to assume that they're safe and trusted. But every company must do its own assessment of risk and benefit.

Discover how Okta can help you decide if federated authentication or single sign-on authentication is the more secure solution for your organization.

Frequently asked questions

What is the difference between federated identity and single sign-on (SSO)?

SSO allows a user to authenticate once and access multiple systems, while federated identity extends this concept by enabling identity sharing across separate organizations or platforms that have agreed on shared standards and protocols.

What are the seven laws of identity that underpin federated identity systems?

The seven laws cover user control and consent, minimal disclosure, justification for access, directed identity, support for competition among providers, human integration into the process, and a consistent user experience across platforms.

Which protocols and technologies are commonly used in federated identity management?

Common technologies include Security Assertion Markup Language (SAML), OAuth, and OpenID. Security tokens such as JSON Web Token (JWT) and SAML assertions are used to pass permissions between platforms.

Is federated identity management secure?

While no authentication protocol is entirely without risk, a federated program built to standard specifications is generally considered more secure than most alternatives. Known vulnerabilities exist in some protocols, so organizations should assess their specific risk profile.

What role does the U.S. government play in federated identity standards?

Government interest in federated identity dates to Homeland Security Presidential Directive 12 (2004), which required secure credentials for accessing government assets. Ongoing work by the National Cybersecurity Center of Excellence aims to release a set of federated identity standards for broader use.

What are the main benefits of adopting federated access for an organization?

Key benefits include reduced costs by eliminating the need to build custom SSO solutions, improved employee efficiency through fewer repeated logins, and stronger data protection by minimizing the number of individual login points that could be exploited.