Identity federation sub-processors make that possible. They are the third-party services that connect, authenticate, and pass user identity data between platforms in a single sign-on or cross-domain access flow. In a federated identity system, sub-processors handle tasks your core system does not own directly, such as validating tokens, exchanging metadata, or mapping claims between providers.
When you integrate with an identity federation, you are agreeing to a trust network. Every sub-processor in that network becomes part of your data handling chain. They receive, process, or store identity payloads—sometimes only briefly, sometimes longer depending on the protocol. Knowing exactly which sub-processors are in play is not optional. Data protection law, contractual obligations, and security audits all depend on accurate disclosure and control.
Common identity federation sub-processors include SAML brokers, OIDC gateways, session managers, and directory synchronization services. Many operate as managed cloud platforms, optimized for speed and compliance. They parse assertions, enforce policy, and pass on identity data to the application or downstream services. Even when they never see a password, they often hold keys, tokens, or identity attributes that can be sensitive if misused.