Identity federation

Identity federation lets users authenticate once and be trusted by other services, via protocols like SAML and OpenID Connect.

Identity federation is the trust arrangement that lets a user authenticate once with one party and be recognised by other, independent parties, without sharing passwords or re-registering identity data at each of them. An identity provider authenticates the user and issues a signed assertion or token; a relying party trusts that statement because both sides have agreed in advance on the protocol, the assurance level and the legal terms of the federation. SAML 2.0 and OpenID Connect (built on OAuth 2.0) are the two protocol families that carry out this exchange in practice.

Federation is what makes single sign-on possible across organisational boundaries, and it underlies Dutch schemes such as DigiD and eHerkenning: a citizen or employee logs in once with their eID means, and many government services rely on that single authentication event. The EUDI Wallet takes a related but more decentralised approach: instead of a relying party trusting a specific identity provider per session, the user holds verified attributes themselves and presents them directly, which reduces reliance on a live federation link.