Why do we need Identity Providers when enabling SSO? Why can't directory services do it itself when they already have users identity and can verify it (I'm thinking here about MS AD and the need of AD FS to enable SSO).


  • Strictly speaking AD only provides the data store for identity. Other services provide the authentication and authorisation services - such as Kerberos. ADFS provides a standardised federation capability so that authentication and authorisation services can hand-off responsibility in a controlled way. Dec 19, 2016 at 12:51

1 Answer 1


I think the main reason is that Directory Services that have been around for a while such as AD and LDAP were designed strictly as authentication stores for client applications to leverage. SSO was a later development that is application driven. This is why Microsoft developed ADFS to address the integration of SSO with their native AD services to enable third-party applications.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .