TechKnowSurge
ISC2 CISSP 5.3 NIST 800-53 IA-8 NIST NICE K0742 NIST CSF PR.AA-04 ISC2 CISSP 5.6 CompTIA Security+ 4.6 CompTIA SecurityX 2.1 NIST 800-53 IA-2
TechKnowSurge Catalog Videos Federation
VideoSecurityFree

Federation

Federation is the practice of creating trust relationships between separate systems or organizations so that authentication in one grants access to another. This topic covers trust direction, transitive trust, federated identity, how federation differs from single sign-on, and the protocols that support it.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Federation is the practice of linking separate systems or organizations through established trust relationships, so that a user authenticated in one environment is recognized and trusted in another. This model has become increasingly common as organizations merge, partner, or build services that rely on external identity providers rather than managing credentials internally. A federated trust can be configured as one-way, where one organization trusts another but not vice versa, or two-way, where both parties mutually recognize each other's authentication. Transitive trust adds another dimension: if Organization A trusts Organization B and Organization B trusts Organization C, that chain of trust automatically extends to Organization C, unless the relationship is explicitly configured as non-transitive. A federated identity is an electronic credential with associated attributes that allows a user to access resources across multiple unrelated systems without maintaining separate accounts for each. A practical example is a web service that offloads authentication to an established provider like Google or Facebook, redirecting users there for verification and then granting access upon successful authentication, without ever storing usernames or passwords itself. Although this resembles single sign-on, the distinction matters: SSO typically consolidates access to resources within or closely tied to a single organization, while federation connects systems that may have no formal relationship, using a third-party identity provider as the trusted intermediary. The protocols that underpin federation, including SAML, OpenID, and OAuth, define how identity assertions and authentication tokens are structured, transmitted, and validated between parties. Understanding these protocols alongside the concepts of trust direction, transitive trust, and federated identity provides the foundation needed to design, evaluate, and secure modern identity architectures across organizational boundaries.

What you'll learn

What's covered

Federation in Identity Management

Aligned to

ISC2 CISSP
5.3 Federated identity with a third-party service
5.6 Implement authentication systems
NIST 800-53
IA-8 Identification and Authentication (Non-Organizational Users)
IA-2 Identification and Authentication (Organizational Users)
NIST NICE
K0742 Knowledge of identity and access management (IAM) principles and practices
NIST CSF
PR.AA-04 Identity assertions are protected, conveyed, and verified.
CompTIA Security+
4.6 Given a scenario, implement and maintain identity and access management.
CompTIA SecurityX
2.1 Given a scenario, analyze the security requirements and objectives to provide the appropriate authentication and authorization controls.

Key terms

Identity Federation
A system that establishes trust between separate organizations or domains so that users authenticated by one can access resources of another.
Single Sign-On
SSO
An authentication process that allows a user to access multiple applications with one set of credentials.
Authentication
The process of verifying the identity of a user, device, or system.
Federated Identity
An electronic identity and its attributes that can be used to access resources across multiple distinct organizations or systems through established trust relationships.
Transitive Trust
A trust relationship in which if Organization A trusts Organization B and Organization B trusts Organization C, then Organization A implicitly trusts Organization C.
Security Assertion Markup Language
SAML
Security Assertion Markup Language is an XML-based open standard for exchanging authentication and authorization data between identity providers and service providers, widely used to enable single sign-on in enterprise and federated environments.
OpenID
An open standard authentication protocol that allows users to be authenticated by a trusted third-party identity provider to access multiple services.
Open Authorization
OAuth
Open Authorization is an open standard framework that allows third-party applications to obtain limited access to a user's resources on another service without exposing the user's credentials, using access tokens instead of passwords.

Topics

Identity Federation Single Sign On Trust Relationships Federated Authentication Identity Management Iam

Transcript

It's becoming more and more common for us to interlink our systems together. We call that federation. Let's cover what federation is, trust direction, transitive trust, federation versus what SSO is, protocols, and then identity services.

What federation is

The idea behind federation is creating a trust between different systems. Here we've got a system, let's say A, and a system B. We can create a trust between these so that when you authenticate with one, you actually are going to be trusted by another.

Let's come up with a little scenario as an example. Let's say we have company A here and they have just been purchased by company B. So you are part of company A, and when you log in to your company, you're logging on to company A's resources. But now that they're merged to company B, you need to access some of their resources as well. It creates a trust between these two entities, so that when you log on to company A's resources you also have access to company B, and you have that access because of this trust relationship.

Trust direction and transitive trust

A federation trust could either be one-way or two-way. One-way would just mean that one organization trusts another organization but the reverse is not true. A two-way obviously would be where they trust each other.

There's also something called a transitive trust. If company A trusts company B, and company B trusts company C, then company A trusts company C. If it's a non-transitive, that means that this would not be the case, that company A just trusts company B.

Federated IDs

A federated ID is that you have an electronic ID and certain attributes that can be used to access multiple different entities' resources.

Let's look at a common example that's being created nowadays. Let's give a little scenario. You're setting up a bank of web servers and these are going to deliver some sort of service to your end user. However, one thing you don't want to do is you don't want to store people's usernames and passwords; you want to offload that to another entity. So what you can do is you can create a trust where you trust and create a relationship with a Google or a Facebook, or some big service, Microsoft, some service that offers these services. Then what will happen is when your users try to access your bank of servers here, you would send them to be authenticated with Facebook or Google, and then once authenticated they would have access to your services.

Federation versus single sign-on

Now this may sound a little like single sign-on, and rightfully so. The two concepts are very similar and there's some overlap between the two. So what is the difference between single sign-on and these federated IDs?

With single sign-on, you're really dealing with a company, and that company may be the company you're working for. When you sign on to that company, they've set up single sign-on to have access to all their resources. Perhaps it's also dealing with another company or another entity outside the organization that they've created some sort of trust with, but it's still part of the resources that are available to this company; it's not a separate set of resources.

Whereas with a federated ID, it's the concept where this company, company A, may have no association with Facebook or Google, or whatever it is that they're using as this authenticator. So your federated ID is with this other company, and so when you try to log into company A's resources, they're just using the Google and Facebook for the authentication piece, and then you have access to company A.

Protocols

Now there are quite a few protocols out there that are helping support all this. OpenID, SAML and shith are all examples of protocols that help create this scenario, create this ability.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →