Editing Identity and access management (section)

=== Identity federation ===
{{Main|Federated identity}}
Identity federation comprises one or more systems that share user access and allow users to log in based on authenticating against one of the systems participating in the federation. This trust between several systems is often known as a "circle of trust". In this setup, one system acts as the [[Identity provider (SAML)|identity provider]] (IdP) and other systems act as [[Service provider|service providers]] (SPs). When a user needs to access some service controlled by SP, they first authenticate against the IdP. Upon successful authentication, the IdP sends a secure "assertion" to the SP. "SAML assertions, specified using a markup language intended for describing security assertions, can be used by a verifier to make a statement to a relying party about the identity of a claimant. SAML assertions may optionally be digitally signed."<ref>{{Cite journal <!-- Citation bot bypass-->|url = http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf|title = Information Security|access-date = 2015-10-10|first=William E. |last=Burr |first2=Donna F. |last2=Dodson |first3=W. Timothy |last3=Polk |doi = 10.6028/NIST.SP.800-63v1.0.2|year = 2006|citeseerx = 10.1.1.153.2795|journal=NIST Special Publication|oclc=655513066}}</ref>