TechKnowSurge
NIST NICE K0742 NIST 800-53 IA-8 NIST CSF PR.AA-04 ISC2 CC 3.1 NIST NICE K0686 Cisco CCST Cybersecurity 1.3 ISC2 CC 3.2
TechKnowSurge Catalog Videos IAM - Federation
VideoSecurityFree

IAM - Federation

Federation is the practice of linking separate systems through trust relationships so that authentication in one grants access to another. This concept underpins modern identity management, including federated IDs, single sign-on distinctions, and third-party identity services.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Federation is the practice of connecting separate systems or organizations through formally defined trust relationships, allowing a user who authenticates with one entity to be recognized and trusted by another. These relationships can be configured as one-way, where only one organization trusts the other, or two-way, where both parties mutually recognize each other's authenticated users. Transitive trust extends this further: if Organization A trusts Organization B, and Organization B trusts Organization C, then Organization A implicitly trusts Organization C as well. Non-transitive configurations limit trust strictly to the directly linked parties. A federated identity is an electronic credential with associated attributes that can be used to access resources across multiple independent organizations. A practical example is a company that hosts web services but chooses not to store user credentials directly, instead redirecting users to authenticate through a large, established provider like Google or Microsoft before granting access. This differs from single sign-on, which typically operates within a defined organizational boundary and its affiliated resources, whereas federation involves entities that may have no formal organizational relationship beyond the authentication agreement itself. Several protocols support federated identity implementations, including SAML, OAuth, and OpenID, each providing standardized methods for communicating authentication and authorization data between parties. The demand for federation has also given rise to a dedicated identity services industry, where specialized companies handle user verification and account creation on behalf of other organizations. This can include identity proofing steps such as document verification, ensuring that the identity used to access a resource has been rigorously validated by a trusted third party.

What you'll learn

What's covered

Federation

Aligned to

NIST NICE
K0742 Knowledge of identity and access management (IAM) principles and practices
K0686 Knowledge of authentication and authorization tools and techniques
NIST 800-53
IA-8 Identification and Authentication (Non-Organizational Users)
NIST CSF
PR.AA-04 Identity assertions are protected, conveyed, and verified.
ISC2 CC
3.1 Understand identity life cycle management
3.2 Understand logical access controls
Cisco CCST Cybersecurity
1.3 Explain access management principles

Key terms

Single Sign-On
SSO
An authentication process that allows a user to access multiple applications with one set of credentials.
Authentication
The process of verifying the identity of a user, device, or system.
Identity and Access Management
IAM
A framework of policies and technologies that ensures the right users have appropriate access to resources.
Identity Federation
A system that establishes trust between separate organizations or domains so that users authenticated by one can access resources of another.
Federated Identity
An electronic identity and its attributes that can be used to access resources across multiple distinct organizations or systems through established trust relationships.
Transitive Trust
A trust relationship in which if Organization A trusts Organization B and Organization B trusts Organization C, then Organization A implicitly trusts Organization C.
Security Assertion Markup Language
SAML
Security Assertion Markup Language is an XML-based open standard for exchanging authentication and authorization data between identity providers and service providers, widely used to enable single sign-on in enterprise and federated environments.
Open Authorization
OAuth
Open Authorization is an open standard framework that allows third-party applications to obtain limited access to a user's resources on another service without exposing the user's credentials, using access tokens instead of passwords.
OpenID
An open standard authentication protocol that allows users to be authenticated by a trusted third-party identity provider to access multiple services.
Identity Services
A business model in which a third-party organization provides identity verification and authentication services on behalf of another organization.

Topics

Identity Federation Single Sign On Saml Oauth Openid Trust Relationships Identity And Access Management

Transcript

What Federation Is

It's becoming more and more common for us to interlink our systems together. We call that federation.

The idea behind federation is creating a trust between different systems. Here we've got a system, let's say A, and a system B. We can create a trust between these, so that when you authenticate with one, you actually are going to be trusted by another.

Let's come up with a little scenario as an example. Let's say we have company A here, and they have just been purchased by company B. You are part of company A, and when you log in, you're logging on to company A's resources. But now that they're merged with company B, you need to access some of their resources as well. It creates a trust between these two entities, so that when you log on to company A's resources you also have access to company B, and you have that access because of this trust relationship.

Trust Direction

A federation trust could either be one-way or two-way. One-way would just mean that one organization trusts another organization, but the reverse is not true. A two-way obviously would be where they trust each other.

Transitive Trust

There's also something called a transitive trust. If company A trusts company B, and company B trusts company C, then company A trusts company C. If it's non-transitive, that means that this would not be the case — that company A just trusts company B.

Federated ID

A federated ID is that you have an electronic ID and certain attributes that can be used to access multiple different entities' resources.

Let's look at a common example that's being created nowadays. You're setting up a bank of web servers, and these are going to deliver some sort of service to your end user. However, one thing you don't want to do is store people's usernames and passwords. You want to offload that to another entity. So what you can do is create a trust where you trust and create a relationship with a Google or a Facebook or some big service — Microsoft, some service that offers these services. And then what will happen is, when your users try to access your bank of servers here, you would send them to be authenticated with Facebook or Google, and then once authenticated, they would have access to your services.

Federation Versus SSO

Now, this may sound a little like single sign-on, and rightfully so. The two concepts are very similar and there's some overlap between the two. So what is the difference between single sign-on and these federated IDs?

Well, with single sign-on you're really dealing with a company, and that company may be the company you're working for. When you sign on to that company, they've set up single sign-on to have access to all of their resources. Perhaps it's also dealing with another company or another entity outside the organization that they've created some sort of trust with, but it's still part of the resources that are available to this company. It's not a separate set of resources.

Whereas with federated ID, it's the concept where this company, company A, may have no association with Facebook or the Google or whatever it is that they're using as this authenticator. So your federated ID is with this other company, and so when you try to log into company A's resources, they're just using the Google and Facebook for the authentication piece, and then you have access to company A.

Protocols

Now, there are quite a few protocols out there that are helping support all this. OpenID, SAML, shith are all examples of protocols that help create this scenario, create this ability to do this.

Identity Services

This has spurred on a whole new business model called identity services. If company A wants to do some verification steps before somebody creates an account with them, then perhaps they hire company B to carry out those. So if I go to company A and try to create an account, they're going to send me to company B to actually create an account, and perhaps that account even requires extra steps for that verification. Perhaps I need to turn in my driver's license or passport or something to prove who I am. And now I am going to be authenticating, or I'm going to identify myself, through company B to gain access to company A's resources.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →