On this page
What does an identity provider do?
An identity provider (IdP) is a service that checks who a user is and tells applications the result. It takes the login problem out of every application and solves it once, in a place that can be watched, hardened, and audited properly.
Most teams arrive here after the alternative stops scaling. Ten applications with their own password tables is ten reset flows, ten session bugs, and no way to answer who has access to what.
It verifies the user
The sign-in ceremony happens at the identity provider, with whatever factors you configure. Your applications never handle a credential.
It vouches for the user
The result travels as a signed token or assertion that an application can verify without asking anyone. That signature is the whole trust relationship.
It holds the account lifecycle
One directory decides who exists, which groups they belong to, and when access ends. Offboarding becomes one action instead of a checklist.
It records what happened
Sign-in events land in one audit log, which is the only practical way to answer a question about access after the fact.
How does an identity provider work?
The mechanics are the same whether the protocol is OIDC or SAML. Your application does not verify the user. It asks a service it trusts and reads a signed answer.
Everything rests on that signature. The application fetches the provider's public keys, checks the answer against them, and starts a local session only when the check passes.
- A user opens an application and is not signed in.
- The application sends the user to the identity provider.
- The identity provider runs the sign-in ceremony.
- The identity provider returns a signed token or assertion.
- The application verifies the signature and starts a session.
What standards does an identity provider use?
Standards are what stop an identity provider becoming lock-in. Because the wire formats are specified, the client code in your applications is largely portable, and a migration cost lands in configuration rather than in a rewrite.
Each standard below covers a different job. A full provider supports several at once, because a real estate needs several at once.
- OpenID Connect (OIDC): who the user is, as a signed ID token.
- OAuth 2.0: delegated access to protected resources, hardened with PKCE and PAR.
- SAML 2.0: signed XML assertions for enterprise applications.
- SCIM 2.0: account creation, update, and removal across systems.
- CIBA: a sign-in approved out of band on a separate device.
How does SenseCrypt work as an identity provider?
SenseCrypt is a passwordless identity provider (IdP) from Seventh Sense. A user enrolls from a photo already on file and then signs in by face, with no password in the design and no password fallback behind it.
It is a full identity provider rather than an MFA add-on, so it can be the only identity service your applications talk to, or it can federate into the one you already run.
Face login, matched on-device
Capture and comparison run on the user's enrolled device. The server stores no face image and no face template, and each sign-in spends a patent-pending single-use face token.
The standards estate is complete
OIDC, OAuth 2.0 with PKCE and PAR, SAML 2.0, SCIM 2.0, and CIBA, alongside role-based access control, multi-tenant isolation, and audit logs.
Liveness certified, recognition evaluated
Liveness holds iBeta ISO 30107-3 certification at Level 1 and Level 2. Face recognition entered the NIST evaluation in 2021, which was then FRVT and later split into FRTE and FATE, and is maintained through our latest submissions.
Roles are emitted, your application enforces them
SenseCrypt computes roles and permissions and puts them in the token. It also runs a default-closed group gate at sign-in, so a user with no permitted group never reaches your application.
Frequently asked questions
What is an identity provider (IdP)?
An identity provider (IdP) is a service that verifies who a user is. It then tells applications the result. Applications trust the IdP and do not store passwords.
What is the difference between an IdP and single sign-on (SSO)?
An identity provider verifies the user. Single sign-on (SSO) is a feature that the IdP enables. With SSO, one sign in works across many applications.
Is SenseCrypt an identity provider?
Yes. SenseCrypt is a passwordless identity provider (IdP) from Seventh Sense. A user signs in by face. SenseCrypt then confirms the identity to your applications.
What standards does an identity provider support?
A modern identity provider supports OpenID Connect, OAuth 2.0, and SAML 2.0. Many also support SCIM 2.0 and CIBA. SenseCrypt supports all of these.
Related