In the worked example, how do data supply, provisioning and federation fit together?

A primary IdP1 with its registration authority is supplied with data from two data sources; IdP1 then provisions an IdP2 and an application RP1 (which has its own embedded IdP3); and IdP2 in turn serves RP2 and RP3 with federated identities.

* Data supply, provisioning and federation as three layers in one setup. *

The diagram shows all three data flows in one picture:

1. Data supply (Datenversorgung): Data1 and Data2 (for instance HR and student administration) feed IdP1, whose RA validates and registers the identities.
2. Provisioning: IdP1 pushes copies of the identities onwards, to a second identity provider IdP2 and directly into an application RP1. RP1 has its own local IdP3, which is why it needs the data in advance: it authenticates users itself against the provisioned copies.
3. Federation: IdP2 does not copy anything into RP2 and RP3; instead those relying parties redirect users to IdP2 at login and accept its authentication confirmations.

The example makes the point that provisioning and federation are not rivals but layers: provisioning keeps the identity providers and legacy applications supplied, federation delivers the login to modern applications.