Identity Provider
What is Identity Provider?
A service that creates, maintains, and manages identity information and provides authentication services to applications in a federated or SSO environment.
Terms that appear alongside identity provider
Each of these is named in at least one of the same controls as identity provider. The number is how many controls name both.
- threat intelligence 3 shared controls
- nist 3 shared controls
- audit 3 shared controls
- authorization 2 shared controls
- key management 2 shared controls
- tls 2 shared controls
- policy 2 shared controls
- authentication 2 shared controls
Frameworks that govern identity provider
What the standards actually require on identity provider
Requirements naming identity provider across 6 standards, quoted from the control text.
Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.
NIST800-IA-13(1) · IA-13(1) Identity Providers and Authorization Servers | Protection of Cryptographic Keys →Agencies should make sure relying parties draw on every piece of information available from the identity provider when deciding on access control.
new-zealand-information-security-manual-nzism::23.3.22.C.01 · 23.3.22.C.01 Relying parties use all identity provider information →Federate workforce access to AWS through a single corporate identity provider via IAM Identity Center or SAML so that user lifecycle, MFA and access reviews are centrally governed.
SEC02-BP04 · Rely on a centralized identity provider →The organisation employs identity providers and authorization servers to manage identities, attributes and access rights of users, devices and non-person entities supporting authentication and authorization decisions in line with defined policy and mechanisms....
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-13 · IA-13 Identity providers and authorization servers →The bank acts as identity provider when customers are identified and authenticated for access to partner systems, using secure authentication technologies.
rbi-cybersecurity-framework-for-banks::116 · Para 116: bank as identity provider for customer access to partner systems →Security Layer 2 Services per X.805 Clause 7.2: The Services Security Layer is concerned with security of network services that service providers offer to their customers - encompasses the protection of the basic network connectivity services + supplementary v...
X805-Layer2-Services-Security-Frame-Relay-ATM-IP-VoIP-QoS-Toll-Free-IM-VPN-AAA-DNS · ITU-T X.805 Security Layer 2 - Services Security + Frame Relay + ATM + IP + VoIP + QoS + Toll-Free + Instant Messaging + VPN + AAA Authentication-Authorization-Accounting + DNS + IMS + 5G + Cellular Mobile Voice + SMS →Questions people ask about identity provider
What is Identity Provider?
Why is Identity Provider important for compliance?
Which compliance frameworks address Identity Provider?
Where can I learn more about Identity Provider?
See how Identity Provider applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.