---
id: "identity-provider"
type: "kind"
category: "security"
url: "https://localhost:3000/catalogue/kinds/identity-provider"
---

# Identity provider

Authenticates principals and decides authorization.

| | |
|---|---|
| Category | Security |
| Properties | 5 |
| Components | 48 |
| Rules | 0 |

## Properties

| property | type | values | required | default |
|---|---|---|---|---|
| `authorizationModel` | enum | `none`, `rbac`, `abac`, `rebac` | no | "rbac" |
| `centralised` (advanced) | boolean | — | no | true |
| `managed` | boolean | — | no | true |
| `mfa` | boolean | — | no | false |
| `protocol` | enum | `oidc`, `saml`, `oauth2`, `iam`, `custom` | no | "oidc" |

## Rules for this kind · 0

No rule selects this kind or its category.

## Components · 48

### vendor-neutral

- [Generic identity provider](https://localhost:3000/catalogue/components/identity-provider.md) `identity-provider` — the kind itself

### alibabacloud

- [Resource Access Management](https://localhost:3000/catalogue/components/alibaba-ram.md) `alibaba-ram` — 4 defaults

### aws

- [Amazon Cognito](https://localhost:3000/catalogue/components/aws-cognito.md) `aws-cognito` — 4 defaults
- [Amazon Cognito identity pool](https://localhost:3000/catalogue/components/aws-cognito-identity-pool.md) `aws-cognito-identity-pool` — 4 defaults
- [AWS Directory Service](https://localhost:3000/catalogue/components/aws-directory-service.md) `aws-directory-service` — 5 defaults
- [AWS IAM](https://localhost:3000/catalogue/components/aws-iam.md) `aws-iam` — 4 defaults
- [AWS IAM Identity Center](https://localhost:3000/catalogue/components/aws-iam-identity-center.md) `aws-iam-identity-center` — 5 defaults
- [AWS IAM Roles Anywhere](https://localhost:3000/catalogue/components/aws-iam-roles-anywhere.md) `aws-iam-roles-anywhere` — 5 defaults
- [AWS Directory Service Simple AD](https://localhost:3000/catalogue/components/aws-simple-ad.md) `aws-simple-ad` — 5 defaults

### azure

- [Microsoft Azure Attestation](https://localhost:3000/catalogue/components/azure-attestation.md) `azure-attestation` — 4 defaults
- [Microsoft Entra Domain Services](https://localhost:3000/catalogue/components/azure-entra-domain-services.md) `azure-entra-domain-services` — 5 defaults
- [Microsoft Entra External ID](https://localhost:3000/catalogue/components/azure-entra-external-id.md) `azure-entra-external-id` — 5 defaults
- [Microsoft Entra ID](https://localhost:3000/catalogue/components/azure-entra-id.md) `azure-entra-id` — 4 defaults
- [Microsoft Entra Verified ID](https://localhost:3000/catalogue/components/azure-entra-verified-id.md) `azure-entra-verified-id` — 5 defaults
- [Azure IoT Hub Device Provisioning Service](https://localhost:3000/catalogue/components/azure-iot-dps.md) `azure-iot-dps` — 4 defaults
- [Managed identities for Azure resources](https://localhost:3000/catalogue/components/azure-managed-identity.md) `azure-managed-identity` — 5 defaults

### cloudflare

- [Cloudflare One identity provider](https://localhost:3000/catalogue/components/cloudflare-one-identity-provider.md) `cloudflare-one-identity-provider` — 3 defaults

### default

- [Active Directory Domain Services](https://localhost:3000/catalogue/components/active-directory.md) `active-directory` — 5 defaults
- [Athenz](https://localhost:3000/catalogue/components/athenz.md) `athenz` — 5 defaults
- [Auth0](https://localhost:3000/catalogue/components/auth0.md) `auth0` — 4 defaults
- [Authelia](https://localhost:3000/catalogue/components/authelia.md) `authelia` — 5 defaults
- [authentik](https://localhost:3000/catalogue/components/authentik.md) `authentik` — 5 defaults
- [Clerk](https://localhost:3000/catalogue/components/clerk.md) `clerk` — 5 defaults
- [Dex](https://localhost:3000/catalogue/components/dex.md) `dex` — 5 defaults
- [FreeIPA](https://localhost:3000/catalogue/components/freeipa.md) `freeipa` — 5 defaults
- [Keycloak](https://localhost:3000/catalogue/components/keycloak.md) `keycloak` — 4 defaults
- [OAuth2 Proxy](https://localhost:3000/catalogue/components/oauth2-proxy.md) `oauth2-proxy` — 4 defaults
- [Okta](https://localhost:3000/catalogue/components/okta.md) `okta` — 4 defaults
- [OpenFGA](https://localhost:3000/catalogue/components/openfga.md) `openfga` — 4 defaults
- [OpenLDAP](https://localhost:3000/catalogue/components/openldap.md) `openldap` — 5 defaults
- [Ory](https://localhost:3000/catalogue/components/ory.md) `ory` — 5 defaults
- [Ping Identity Platform](https://localhost:3000/catalogue/components/ping-identity.md) `ping-identity` — 5 defaults
- [SpiceDB](https://localhost:3000/catalogue/components/spicedb.md) `spicedb` — 4 defaults
- [SPIRE](https://localhost:3000/catalogue/components/spire.md) `spire` — 5 defaults
- [Stytch](https://localhost:3000/catalogue/components/stytch.md) `stytch` — 5 defaults
- [WorkOS](https://localhost:3000/catalogue/components/workos.md) `workos` — 5 defaults
- [Zitadel](https://localhost:3000/catalogue/components/zitadel.md) `zitadel` — 5 defaults

### gcp

- [Cloud Identity](https://localhost:3000/catalogue/components/google-cloud-identity.md) `google-cloud-identity` — 5 defaults
- [Firebase Authentication](https://localhost:3000/catalogue/components/google-firebase-auth.md) `google-firebase-auth` — 5 defaults
- [Google Identity Platform](https://localhost:3000/catalogue/components/google-identity-platform.md) `google-identity-platform` — 4 defaults
- [Managed Service for Microsoft Active Directory](https://localhost:3000/catalogue/components/google-managed-microsoft-ad.md) `google-managed-microsoft-ad` — 4 defaults

### ibm

- [IBM Cloud App ID](https://localhost:3000/catalogue/components/ibm-app-id.md) `ibm-app-id` — 4 defaults
- [IBM Cloud Identity and Access Management](https://localhost:3000/catalogue/components/ibm-iam.md) `ibm-iam` — 4 defaults
- [IBM Security Verify](https://localhost:3000/catalogue/components/ibm-security-verify.md) `ibm-security-verify` — 3 defaults

### oci

- [OCI Dynamic Group](https://localhost:3000/catalogue/components/oci-dynamic-group.md) `oci-dynamic-group` — 5 defaults
- [OCI IAM with Identity Domains](https://localhost:3000/catalogue/components/oci-identity-domain.md) `oci-identity-domain` — 5 defaults

### openstack

- [OpenStack Keystone](https://localhost:3000/catalogue/components/openstack-keystone.md) `openstack-keystone` — 5 defaults

### outscale

- [Elastic Identity Management (EIM)](https://localhost:3000/catalogue/components/outscale-eim.md) `outscale-eim` — 5 defaults

## Source (`kind` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../schema/kind.schema.json
# Abstract kind: Authenticates principals and decides authorization (IAM, OIDC providers, Zanzibar-style authorization services).
schemaVersion: "1"
type: "kind"
id: "identity-provider"
category: "security"
properties:
  protocol:
    type: "enum"
    values: ["oidc", "saml", "oauth2", "iam", "custom"]
    default: "oidc"
  authorizationModel:
    type: "enum"
    values: ["none", "rbac", "abac", "rebac"]
    default: "rbac"
  centralised:
    type: "boolean"
    default: true
    advanced: true
  mfa:
    type: "boolean"
    default: false
  managed:
    type: "boolean"
    default: true
```

Human page: https://localhost:3000/catalogue/kinds/identity-provider