Identity provider

As explained in Building Distributed Applications that Work

An identity provider is a system that authenticates principals and supplies identity information and access-related assertions to applications.

An identity provider (IdP) is a dedicated service that stores users’ credentials and helps applications verify that users are authenticated. When multiple applications rely on the same IdP, a user can sign in once and access other applications protected by it. This is single sign-on (SSO). section 8.1

A typical sign-in flow works like this:

• A user requests a protected page without being logged in. The application redirects the user to the IdP’s login page. section 8.1
• After the user authenticates, a redirect returns them to the requested page with a token containing their details and confirming authentication. section 8.1
• The token is stored temporarily, such as in a browser cookie. It lets the user access applications protected by the same IdP until it expires; continued activity can refresh it. section 8.1

Signing in across websites

Signing in to Chrome with a Google account can let a user reuse those credentials on websites offering Sign in with Google. section 8.1

The IdP handles shared SSO security, while authentication and authorization answer different questions: who a client is, and whether that client may access a resource. OIDC is commonly used for authentication, and OAuth can provide authorization alongside it. In an Aspire-hosted application, an internally hosted IdP can be reached through service discovery. section 8.1 section 8.6

Figure 8.1 SSO flow

Follow the SSO flow from the protected resource to the IdP login and back to the application. section 8.1

How Building Distributed Applications that Work covers it

How deep it goes

Explains the redirect-and-token sign-in flow at a high level, without detailing IdP implementation.

Examples

Illustrates Google account reuse and a protected-page redirect that returns an authentication token.

What it assumes

Introduces SSO and the IdP sign-in flow without assuming familiarity with either.

What you can do after

Evaluate/understand how an IdP enables SSO and fits into security for Aspire-hosted applications.

How it connects

Links single sign-on, authentication, authorization, OIDC, OAuth, and Aspire service discovery.

liveBookmanning.com

Read Building Distributed Applications that Work on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eA third-party identity service is an externally operated identity provider that supplies authentication and identity-management capabilities to applications.
• 

  liveBookmanning.com
  Effective Platform EngineeringAn identity provider is a system that authenticates entities and supplies identity or authorization information to relying applications and services.
• 

  liveBookmanning.com
  Software Security for DevelopersAn identity provider is a system that authenticates identities and provides identity information to relying applications or services.
• 

  liveBookmanning.com
  .NET in Action, Second EditionAn identity provider is a service that authenticates users and supplies identity and authorization metadata to client applications.
• 

  liveBookmanning.com
  Secure APIsAn identity provider is a service that authenticates identities and issues identity or authorization artifacts to relying clients.
• 

  liveBookmanning.com
  MongoDB 8.0 in Action, Third EditionAn identity provider is a service that authenticates users and supplies verified identity information to relying applications or services.
• 

  liveBookmanning.com
  Architecting an Apache Iceberg LakehouseAn identity provider is a system that authenticates users or services and supplies their identities and authorization context to other systems.
• 

  liveBookmanning.com
  Build Python Web Apps with StreamlitAn identity provider is a service that authenticates users and supplies identity information to relying applications.
• 

  liveBookmanning.com
  Terraform in Depth: Infrastructure as Code with Terraform and OpenTofuAn identity provider is a system that authenticates identities and issues identity assertions or tokens to relying systems.
• 

  liveBookmanning.com
  Grokking Web Application SecurityAn identity provider is a service that authenticates users and supplies identity assertions or authentication services to other applications.
• 

  liveBookmanning.com
  Authorization in ActionA central identity provider is a service that centrally manages digital identities and supplies authentication or identity information to relying applications or other systems.

Compare how 12 books explain identity provider →

Related concepts

• single sign-onused by · Single sign-on is an authentication arrangement in which one authentication event enables a user to access multiple applications or services without signing in separately to each.
• federated identity integrationused by · Federated identity integration is an arrangement in which systems or organizations trust identity and authentication assertions exchanged across their boundaries.
• security tokenproduces · A security token is a credential or assertion presented to a service to convey authenticated identity, authorization, or session information.
• tokenproduces · A token is a discrete unit of text, such as a word, word fragment, character, or symbol, represented and processed as an element by a language model.
• Microsoft Entra IDused by · Microsoft Entra ID is Microsoft's cloud-based identity and access-management service for authenticating users, applications, and services and controlling their access to resources.

This explainer was generated by Manning's knowledge graph from the text of Building Distributed Applications that Work. The section links point to the parts of the book it draws on.