3.2.2 Identity Provider (IdP)

Before · SP 800-63C

After · SP 800-63C-4

Identity Provider (IdP)

Before · SP 800-63C

After · SP 800-63C-4

The IdP provides a bridge between the subscriber account (as established by the CSP) and the RP that the subscriber is accessing. An IdP can be deployed as a service for multiple subscriber accounts or as a component controlled by a single subscriber, such as a subscriber-controlled wallet on the subscriber’s device.

The IdP establishes an authentication event with the subscriber, either through the verification of an authenticator (for general-purpose IdPs) or the presentation of an activation factor (for subscriber-controlled wallets). The IdP creates assertions to represent the authentication event.

The IdP augments the subscriber account from the CSP with federation-specific items, including but not limited to the following:

• One or more external federated identifiers for use with a federation protocol
• A set of access rights that detail which RPs can access which attributes of the subscriber account (such as allowlists and saved runtime decisions by the subscriber)

• Federated account usage information

• Additional attributes collected by or assigned by the IdP to the account

The IdP makes the identity attributes of the subscriber available within the assertion or through an identity API (see Sec. 3.12.3 ).

In some systems, this is also known as the offering party (OP).