In this lesson,
we're going to cover the concept
of Federation.
In the world of identity and access management,
Federation refers to a process that allows
for the linking of electronic identities
and attributes to store that information
across multiple distinct identity management systems.
Federation allows users to use the same username,
password or other credentials
to log into multiple systems managed
by different organizations.
But this is more like a single sign-on
than a password reuse type of situation.
Federations work by using the trusted relationships
that exist between different systems.
When a user logs into a system,
that system can then use the Federation
to verify the user's identity with another system.
Federation is a concept that extends
beyond the traditional boundaries
of an organization's network and instead recognizes
that there is a need for your network to be accessible
to a broader group of users,
including not just your employees
but your partners, suppliers, and customers as well.
While managing employee accounts can be straightforward,
managing accounts for each partner, supplier,
or customer internally can be much more challenging.
This is where a Federation comes
into play by allowing the organization's network
to trust accounts created
and managed by a different network.
This means that a supplier or customer can authenticate
using their own network credentials
and then your company's network can trust
this authentication
because of a pre-established trust relationship
between the two systems.
Now, let's take a quick look
at a simplified step-by-step approach that is occurring.
When someone tries to log
into a system using a Federation.
To log in using a Federation,
you'll follow a six step process
including login initiation,
redirection to an identity provider,
authenticating the user,
generation of an assertion,
returning to a service provider,
verification and access.
And finally, the login is complete.
First, the user will initiate a login.
This occurs when the user accesses a service
or application and chooses to log in.
The system will recognize
that it's a federated login based on the domain
and the user's credentials or other predefined criteria.
Second, the user will be redirected
to the identity provider.
The service or application,
often termed the service provider,
will redirect the user
to the home network
or identity provider known as the IdP for authentication.
And this is where the user's credentials are being stored
and they will be used to validate the specific user.
Third, we have to authenticate the user.
Once the user enters their credentials
such as their username or password
with the identity provider,
the identity provider will validate the user's identity
which serves as the authentication mechanism
during their login activity.
Fourth, we have the generation of an assertion.
Once authenticated,
the identity provider will create an assertion,
usually a token that includes information
about the user's identity,
their authentication status,
and possibly other attributes.
This assertion is created in a standardized format
depending on which protocol is being used
such as SAML or OpenID Connect.
Fifth, the user is returned to the service provider.
This redirection will cost the user to be returned
to the initial service
or application that they wanted to access,
which we refer to as the service provider,
with the assertion
that they just received from the identity provider.
Sixth, verification and access occurs.
During this step,
the service provider will verify the assertion to ensure
that it's from a trusted identity provider
and then the service provider will grant the user
access based off the information and the assertion.
And now the Federation process is complete.
The user now has access
to the service or application,
and potentially others
within Federation without needing to log in again.
From an endpoint user perspective,
Federation is a great thing because they only
need to have a single account to be able
to access a wide variety of services and applications.
To configure Federation
across multiple organizational networks,
we usually rely
on a technology like SAML, OAuth, and OpenID Connect
as our authentication and authorization protocols.
Federations offer us benefits including
simplified user experience,
reduce administrative overhead,
and increased security.
Since Federations require
that a user only has to remember one set of credentials,
this makes the entire login process much simpler
and much more efficient.
Also, since organizations don't need to manage accounts
for every individual user
and instead they can just trust the authentication provided
by the user's home network.
This helps to reduce the administrative overhead required
from our organizations.
And since users are less likely to reuse passwords
or resort to insecure password storage methods,
the security of the network is improved
and the risk of password related
security breaches is reduced.
So remember, using a Federation allows users
to utilize the same username, password,
or other credentials to log
into multiple systems managed by different organizations.
Federations work by using a trusted relationship
between different systems
offering several benefits,
which include improved user experience,
increased productivity, reduced IT costs,
and enhance security.