How does the hub-and-spoke model work?

A central intermediary infrastructure, the broker, sits between identity providers and relying parties; all parties trust the broker, and IdPs and RPs no longer talk directly but exchange their messages via the broker, which checks them and forwards them to the right recipient.

* Hub-and-spoke: every message passes through the broker, which checks it and forwards it. *

In the diagram the subject is redirected to the broker (Vermittler), the broker forwards the authentication to one of several IdPs, and the resulting confirmation flows back through the broker to the relying party.

The model replaces many bilateral trust relationships with one trust relationship per participant: each IdP and each RP trusts only the broker. That solves the scaling problem of the full mesh, and it gives one place where common services (discovery, attribute mapping, protocol translation) can be offered to everyone. The price is that the broker becomes both a single point of failure and a single point of observation: it sees every authentication in the federation.