2.2.5. Federation
💡 First Principle: Federation is a trust relationship between two separate identity systems that lets a user authenticated by one system be recognized and trusted by the other, without needing a separate set of credentials in the second system — it's what makes "sign in once, access many organizations' resources" possible.
Federation is what allows a user at Company A to sign into a SaaS application owned by Company B using their Company A credentials — Company B's application trusts tokens issued by Company A's identity provider because a federation trust was established in advance. This is the mechanism behind much of business-to-business collaboration and behind protocols like SAML and OpenID Connect issuing portable proof of authentication.
⚠️ Exam Trap: Federation is not the same as simply sharing a password database. No credentials are shared or duplicated between the two organizations — only a trust relationship and signed tokens are exchanged.
Reflection Question: Two companies want employees to access each other's internal applications using their own company credentials, without IT support creating duplicate accounts in both directories. Which identity concept solves this, and what gets established between the two organizations to make it work?
