What is an intermediary (Vermittler), and which services does it bundle?

An intermediary offers shared services for all IAM service providers and relying parties in a hub-and-spoke federation: metadata management, IdP discovery (discovery service), identity linking, and transformation of authentication and attribute assertions (broker service); an authentication proxy is always an integral part of it.

Synonyms: hub, broker. The broker service is the IAM service that mediates between subject, resources and the runtime IAM services and federates assertions; the discovery service (also "WAYF", where are you from) routes the subject to the IdP of its choice.

Go deeper:

• NIST SP 800-63C-4 Federation and Assertions — how assertions carry authentication and attribute statements from an IdP to a relying party, including brokered federation.