Software Architect's Handbook

Implementing a centralized identity provider (IdP)

Many modern applications have to interact with APIs that are not in the same domain and may not be under its control. A web application, mobile application, or API may need to communicate with other applications and APIs outside its domain, requiring them to be public. Domain authentication is not sufficient for this case. The ability to grant access to resources across applications without sharing login credentials is a common requirement and can be accomplished by implementing a centralized identity provider (IdP).

Another advantage of an identity provider is that the applications that we build do not have to be responsible for authentication. Instead, that task becomes the responsibility ...