Which three main actors does an IAM system know, and which roles can the IAM service provider take?

Subject, relying party and IAM service provider; the service provider appears in the roles identity provider (IdP), registration authority (RA) and intermediary (broker).

* The three main actors and the three roles an IAM service provider can play. *

The actors describe who plays which part in the four-question game:

• Subject: the person or machine that wants access.
• Relying party (RP): the application that owns the resource and relies on IAM information to protect it.
• IAM service provider, which can take one or more roles:
  • Identity provider (IdP): issues and manages digital identities and authenticates subjects.
  • Registration authority (RA): registers and identifies subjects and authorises creation of an identity.
  • Intermediary (Vermittler, broker): sits between IdPs and RPs and offers shared services in a federation.

In a small web shop all three actors are merged in one system; in a federation such as Switch edu-ID they are separate organisations that must trust each other, and much of IAM design is about how that trust is established.

Go deeper:

• NIST SP 800-63C-4 Federation and Assertions — how identity providers, relying parties and assertions interact in a federation.