Sign-in service (IdP): what it is and how it is attacked
The single service that proves who someone is, for every application.
Also known as
- IdP
- SSO
- identity provider
- Entra ID
- Okta
Typing any of them into the editor finds this object.
Why it matters on a security diagram
One sign-in unlocks everything connected to it, which is convenient for staff and for whoever takes it over.
How it gets attacked, and what reduces it
How it gets attacked
- Session tokens stolen after a legitimate sign-in
- Trust settings altered to accept identities from elsewhere
What reduces it
- A phishing-resistant second factor, because a code or prompt can be relayed in real time
- Review which applications have been granted standing access, since that access survives a password reset
- Alert on changes to trust settings, which is how identities from elsewhere get accepted
Where it sits
- Group
- Identity · Who something claims to be, and what proves it.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- identity-provider
Reviewed . CC BY 4.0.
Others in identity
- Directory serviceActive Directory · AD · DC · LDAP · domain controller · staff directory · identity storeThe system that holds every account and computer, and decides what each one is allowed to do.
- Second factorMFA · 2FA · multi-factor authenticationA second proof of identity beyond the password.
- Machine accountservice account · robot account · non-human account · application accountAn account used by software rather than by a person.
- CertificateTLS certificate · PKI · code signing certificateA digital document proving something is genuinely what it claims to be.
- Access badgeproximity card · prox card · RFID card · fob · smart card · staff passThe card or fob a person holds against a reader to open a door.
The identity group lists all 6 of them side by side.
Sign-in service on your own diagram
Open the editor, press N, and type IdP. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker