What is the central-identity model, and where do you meet it?

In the central model the relying party delegates creation and management of identities to a specialised identity provider and uses identities issued and maintained by another organisation; these are federated identities. Social login (Google, Facebook, Microsoft) and the central authentication service of an enterprise are typical examples.

* Central identity: the identity moves to a separate identity provider; the relying party keeps only application-specific data. *

The topology is "central identity", and from the user's view it is still externally determined, because the IdP, not the user, controls the identity.

What changes compared to the isolated model is the division of labour: the RP keeps its application-specific user data and rights, but the identity (identifier, attributes, credentials) lives at the IdP. The RP trusts the IdP's statements about who has just logged in.

The two typical settings differ in who the IdP is: on the consumer web it is a large platform offering "social login"; inside an enterprise it is the company's own central authentication service, often Active Directory with a single-sign-on layer on top.

Go deeper:

• Social login (Wikipedia) — the consumer-web form of the central model, with its convenience and privacy trade-offs.