What Is Federated Identity?

Federated identity, often called federated identity management or FIM, is an arrangement in which independently administered organizations agree to accept authentication decisions and user attributes issued by one another. Instead of holding a separate account for every service a person uses, a federation allows one party, the identity provider, to vouch for a user to another party, the relying party, by issuing a signed statement known as an assertion. The relying party never handles the user's password or authenticator, only the identity provider's claim that verification took place. Separating the authentication event from the service being accessed is the defining structural feature of the model, and it is what distinguishes federation from password synchronization or shared account directories.

The approach grew out of enterprise single sign-on work in the late 1990s, when universities and large firms needed to admit staff to externally hosted services without exporting credential databases. It sits within the broader discipline of identity management systems, drawing on public-key cryptography, directory services, and access control theory. United States federal guidance now treats federation as a first-class part of digital identity architecture: NIST Special Publication 800-63C defines the participants, the assertion formats, and the assurance requirements that a federated transaction must satisfy.

Assertions and Trust Agreements

An assertion carries a subject identifier, a statement about how and when authentication occurred, an audience restriction naming the intended relying party, and a validity window. Assertions are either signed directly or fetched from the issuer over a protected channel, and the usual serialization in current protocols is the JSON Web Token described in RFC 7519. Before any assertion is honored, the two sides establish a trust agreement that fixes which attributes will be released, under what legal or contractual terms, and how keys are published and rotated. Trust agreements may be bilateral, negotiated between a single provider and a single service, or multilateral, mediated by a federation operator that publishes metadata for hundreds of members. Research and education federations such as eduGAIN and InCommon use the multilateral pattern to connect universities to library systems, computing facilities, and cloud services.

Federation Protocols

Three protocol families dominate practice. Security Assertion Markup Language 2.0, standardized by OASIS in 2005, encodes assertions in XML and remains common in enterprise and academic deployments. OAuth 2.0 addresses delegated authorization rather than authentication, issuing access tokens that let an application act on a resource owner's behalf without receiving the owner's credentials. OpenID Connect adds an identity layer on top of OAuth 2.0, defining an ID token and a standard set of claims, and it is the usual choice for new web and mobile integrations. System for Cross-domain Identity Management, or SCIM, complements these by provisioning and deprovisioning accounts so that a relying party knows about a user before the first login and removes the record after departure.

Assurance, Privacy, and Risk

Federation concentrates risk at the identity provider, so guidance grades deployments by federation assurance level, which ranges from a bearer assertion presented over a protected channel to an assertion cryptographically bound to a key the subscriber holds. Two privacy concerns shape design choices: attribute minimization, which releases only the claims a service genuinely needs, and provider tracking, since an identity provider can observe every service its users visit. Pairwise pseudonymous identifiers, which give each relying party a different opaque subject value, limit correlation across services.

Applications

Federated identity has applications in a range of settings, including:

• Enterprise single sign-on across on-premises and cloud applications
• Research and education access to shared instruments, journals, and computing resources
• Government service portals that reuse a single citizen credential
• Business-to-business supply chain and partner portals
• Consumer social login and mobile application authorization