What is an identity provider (IdP)?

An identity provider (IdP) is the service that knows who your users are. It stores their accounts, signs them in (with a password, passkey, social login or MFA), and then vouches for them to other applications, so those applications don't handle passwords themselves.

When you click "Sign in with Google" on a website, Google is the identity provider. When your company's Okta or Entra ID login opens before Slack or Salesforce, that's the company's identity provider.

What an IdP does

• Stores identities: users, their profile attributes, groups and roles, or reads them from a directory such as Active Directory.
• Authenticates: checks passwords, passkeys, one-time codes and MFA, and applies policies such as lockouts.
• Issues signed statements to applications: OpenID Connect ID tokens, SAML assertions or CAS tickets saying who the user is.
• Keeps a session, which is what makes single sign-on work: the second app doesn't ask for a password again.
• Manages the lifecycle: sign-up, password reset, provisioning to apps (SCIM), and signing users out.

IdP vs service provider

The app that trusts the IdP is called a service provider (SP) in SAML and a relying party (RP) or client in OpenID Connect. The flow is the same in both:

1. The user opens the app, which redirects them to the IdP.
2. The IdP signs them in, or recognizes an existing session.
3. The IdP sends them back with a signed statement of their identity.
4. The app checks the signature and starts its own session.

The app never sees the password, and adding MFA or passkeys at the IdP protects every connected app at once.

Types of identity providers

An IdP can also federate: accept logins from another IdP. A B2B app's IdP, for example, can let each customer's employees sign in through that customer's own Okta or Entra ID.

How to choose an IdP

• Protocols: OpenID Connect for apps you build; SAML for SaaS tools and enterprise customers; LDAP, RADIUS or CAS if you have older apps or network devices.
• Who signs in: employees, customers, or both, and whether you need organizations for B2B customers.
• Hosting and data location: a multi-tenant cloud service, a dedicated managed instance, or self-hosted.
• Pricing model: per user or monthly active user, per enterprise connection, or flat.
• Extras: MFA and passkeys, user self-service, admin console, provisioning, audit logs.

An open-source IdP: Casdoor

Casdoor is an open-source identity provider under Apache-2.0. It's an OpenID Connect provider and OAuth 2.0 authorization server, a SAML 2.0 IdP, a CAS server, and it serves LDAP and RADIUS for older apps and network devices. It can also federate with Google, GitHub, Entra ID, Okta and other social and enterprise IdPs, and adds MFA, passkeys, organizations, SCIM and an admin console.

Self-host it for free, or run it on Casdoor Cloud: a dedicated instance from $24/month billed yearly. See also What is SSO, SAML vs OIDC and the best open-source IAM tools.

FAQ

Is an IdP the same as SSO? SSO is what users experience; the IdP is the service that provides it.

Is Active Directory an identity provider? Active Directory is a directory. With AD FS or by syncing to a cloud or open-source IdP, its accounts can sign in to web apps over SAML or OpenID Connect.

Can I build my own IdP? You can, but signing, sessions, MFA, recovery flows and protocol details are easy to get wrong. Using an existing IdP, self-hosted if you need control, is usually safer.

What is an IdP-initiated login? In SAML, the user starts at the IdP's portal and clicks the app, instead of starting at the app. Many SAML IdPs, Casdoor included, support both.