What is the isolated-identity topology, and what is a typical example?

An isolated (local) identity is one where the relying party has its own built-in user management, playing IdP and RA itself; from the user's view it is externally determined. The classic example is a web shop with its own customer accounts.

* Isolated identity: registration authority, identity provider and application all live inside the relying party. *

In the diagram, the subject accesses the RP directly, and both the registration authority and the identity provider sit inside the RP. There is no external party at all: the shop registers you, stores your password, authenticates you and decides what you may do.

This is the simplest possible model and the historical default. Every application built before federation became common looks like this, which is why most organisations still have dozens of isolated identity silos alongside their central systems. Its problems for users and for the RP are the subject of the next two cards.