--- title: "Service Provider — Identity Glossary | IDSync" description: "A Service Provider (SP) is an application that delegates authentication to an Identity Provider and consumes signed identity assertions to grant access…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Service Provider", "item": "https://idsync.com/glossary/service-provider" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/service-provider", "name": "Service Provider", "alternateName": [ "SP", "SP", "Relying Party", "RP" ], "description": "A Service Provider (SP) is an application that delegates authentication to an Identity Provider and consumes signed identity assertions to grant access — 'Sign in with Okta' makes Salesforce the SP and Okta the IdP. In OIDC the equivalent term is Relying Party (RP).", "url": "https://idsync.com/glossary/service-provider", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Service Provider Architecture # Service Provider (SP) A Service Provider (SP) is an application that delegates authentication to an Identity Provider and consumes signed identity assertions to grant access — 'Sign in with Okta' makes Salesforce the SP and Okta the IdP. In OIDC the equivalent term is Relying Party (RP). Last reviewed 3 months ago Key points - SP is the SAML term; Relying Party (RP) is the OIDC term — same concept. - The SP trusts the IdP's signature, never sees the user's password (in pure SSO). - SPs are configured per-IdP via SAML metadata XML or OIDC dynamic/manual client registration. - Modern SaaS apps are usually SPs; on-prem apps often need an SP proxy (Cloudflare Access, F5, Okta Access Gateway). - Same app can be both an SP (toward your IdP) and an IdP (toward downstream services) — common in B2B SaaS. ## What is a Service Provider? A **Service Provider (SP)** — also called a **Relying Party (RP)** in OIDC — is any application that _consumes_ authentication from an Identity Provider instead of running its own login. Salesforce, Slack, GitHub, Workday, and almost every modern SaaS app act as SPs when configured for SSO. The SP's job is narrow but critical: 1. Recognize that an unauthenticated user is trying to reach a protected resource. 2. Redirect them to the configured IdP (via SAML AuthnRequest or OIDC authorization request). 3. When the user returns with a signed Assertion (SAML) or ID token (OIDC), validate the signature, issuer, audience, expiry, and nonce. 4. Establish a local session and map the IdP's claims to a local user / role. ## SP vs IdP — who does what | | IdP | SP | | --- | --- | --- | | Authenticates user | Yes | No | | Holds credentials | Yes | No | | Enforces MFA / conditional access | Yes | Optional | | Provisions user accounts | Issues identities | Often receives via [SCIM](/glossary/scim) | | Examples | Okta, Entra ID, Google, Auth0 | Salesforce, Slack, GitHub, Notion | ## Configuration For each IdP↔SP pair you typically configure: - **SAML**: exchange metadata XML (entity IDs, signing certs, ACS URL, SLO URL). Attribute mappings (which IdP claims become which SP attributes). - **OIDC**: register a client (client\_id, client\_secret or PKCE, redirect\_uri, scopes). Configure JWKS endpoint and userinfo mapping. ## When buyers care - **SSO tax** — many SaaS vendors gate SAML/OIDC behind an enterprise tier (`sso.tax` is a community-maintained shame list). Factor that into TCO. - **Just-in-time (JIT) provisioning** — does the SP auto-create users on first sign-in, or do you also need SCIM? - **Deprovisioning** — is the SP an [SCIM target](/glossary/scim) so you can offboard? - **B2B SSO** — does the SP support multiple IdPs per tenant (yes for products built on WorkOS, Auth0, Frontegg; often not for legacy SaaS)? ## Editorial note The number of SPs you operate is the real driver of identity cost. A 200-app SaaS estate that's all SCIM + SSO is cheaper to run than a 50-app estate that's half-manual. IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [iam platforms](/directory/category/iam-platforms) ### Related terms [identity provider](/glossary/identity-provider)[sso](/glossary/sso)[saml](/glossary/saml)[openid connect](/glossary/openid-connect) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the iam platforms category. [Explore tools](/directory/category/iam-platforms) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.