An Identity Provider (IdP) is a trusted service that authenticates users and issues assertions or tokens confirming their identity to other applications, which are called relying parties or service providers. Rather than each application maintaining its own password store, they delegate the act of proving identity to the IdP.
This is the engine behind single sign-on and federation. A user authenticates once to the IdP, and that provider vouches for them across many connected services using protocols such as SAML, OAuth 2.0, or OpenID Connect. Okta, Microsoft Entra ID, and Google are common examples. Centralizing authentication brings clear benefits: consistent multi-factor enforcement, one place to disable a departing employee, and a single audit trail. It also concentrates risk. If the IdP is compromised, an attacker can impersonate anyone who trusts it, which is why hardening, monitoring, and strong administrator controls on the IdP are non-negotiable. The trust between an IdP and its relying parties must also be protected, because a forged assertion undermines every downstream service.
How is an Identity Provider tested on the CISSP?
The IdP concept is central to Domain 5 (Identity and Access Management), which is 13% of the exam. Expect questions on federation, single sign-on, and the trust relationships involved. Study Domain 5 Identity and Access Management for the full picture.