WS-Federation is an identity federation specification which makes it possible to setup a SSO federation including multiple security realms. A realm (sometimes also called domain) represents a single unit under security administration or a part in a trust relationship.
Entities
Within the WS-Federation standard the following entities are defined:
- Relying Party (RP)
The relying party is a resource (web application or service) which consumes security tokens issued by the Security Token Service.
- Requestor
A requestor is a user who wants to access a resource (relying party).
- Identity Provider (IDP)
An Identity Provider can act as an authentication service to a requestor (in this case it is also called “Requestor IDP” or “Home-Realm IDP”) as well as an authentication service to a service provider (also called “Relying Party IDP”). If a user tries to access a relying party within his own security domain, the “Requestor IDP” and the “RP-IDP” can be the same IDP instance. An IDP can also be seen as an Web-Frontend (Extension) of an STS.
- Security Token Service (STS)
A Security Token Service is a web service that validates user credentials and issues security tokens which can include user attributes (also called claims). The security token can be used at the Relying Party to authenticate the requestor’s identity.
Passive Requestor Profile
The “Passive Requestor Protocol” of the WS-Federation standard deals with web-browser based access of a resource like a web portal or a web application.
