Identity provider (IdP)

An identity provider (IdP) authenticates users and vouches for their identity, enabling identity federation and single sign-on across trusted services.

An identity provider is the party that authenticates users and vouches for their identity towards other services (the relying parties). This works through identity federation, the trust arrangement that lets the relying party accept the IdP's assertions instead of managing accounts itself.

Examples span from corporate IdPs (Entra ID, Okta) to national schemes (DigiD, eHerkenning with its brokers) and a qualified trust service provider (QTSP) like Cleverbase with its Cleverbase app (formerly known as Vidua). The most common federation protocols are SAML and OpenID Connect, though OAuth 2.0 and older standards such as WS-Federation also occur; the assurance the IdP can offer is graded by assurance level.

Note: OAuth 2.0 is an authorization framework for granting access to resources, not an identity assertion protocol; using it alone to log users in is a common mistake, which is why OpenID Connect was built as an identity layer on top of it.

Under eIDAS 2.0, the EUDI Wallet introduces a different model: instead of the relying party asking an IdP to vouch for the user online ("phone home"), the user holds verifiable attestations in the wallet and presents them directly, reducing reliance on a central identity provider for each transaction.