What is an identity provider?
Definition
An identity provider (IdP) is a trusted service that confirms who you are and tells another service, such as an app or website, so you can sign in there without a separate password.
- Category
- Identity
- Also called
- IdP, identity provider IdP
- Last updated
NIST's glossary describes an identity provider as a trusted party in a federation transaction that makes an assertion about a subscriber and sends it to the relying party. In plain terms: you prove who you are to one service you trust, and that service vouches for you to another.
Every time you click "Sign in with Google" or "Continue with Apple", or sign in to work apps through a company login page, an identity provider is doing this. The app you are signing in to (NIST calls it the relying party) never sees your password. It receives a confirmation from the provider that you are who you say you are, and sometimes a few details such as your name and email address.
A typical case: you open a project tool at work, it sends you to your company's sign-in page, you enter your password and approve a prompt on your phone, and the tool lets you in. The company sign-in page is the identity provider.
Why it matters
One identity provider account can unlock many other accounts. That is convenient: one strong password and a second step protect everything behind it. It also means that if someone takes over that one account, they can reach all the services signed in through it. The details the provider shares with each app are also worth checking, because they are a way your name and email spread.
Identity provider vs. related terms
- A password manager stores your passwords. An identity provider replaces the need for a separate password at each service.
- Two-factor authentication is an extra check that protects the sign-in to the provider.
- A credential service provider is the related NIST term for the party that issues or registers your authenticators and credentials.
How to protect yourself
- 1
Protect your main identity account hardest
Use a long, unique password and turn on two-factor authentication for the account you use to sign in elsewhere, such as your Google, Apple or Microsoft account.
- 2
Prefer a security key or authenticator app
They are harder to intercept than text message codes.
- 3
Review which apps you signed in to
In your account's security settings, look for connected apps and remove the ones you no longer use. Each one is a place that holds your details.
- 4
Check what each app can see
When you choose a sign-in option, read which details it will share. Pick the option that shares the least if you have a choice.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is Google an identity provider?
Yes, when you use Sign in with Google on another site, Google acts as the identity provider and confirms your identity to that site.
What is the difference between an identity provider and a relying party?
The identity provider confirms who you are. The relying party is the app or website that accepts that confirmation and lets you in.
Is signing in with an identity provider safer than a separate password?
It can be, because there are fewer passwords to reuse or leak, as long as the provider account itself has a strong password and two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.