The two sides speak different protocols
An application that only supports SAML 2.0, a provider that only issues OpenID Connect tokens, a legacy system that wants LDAP. Each mismatch becomes a custom adapter, or an application nobody includes.
Identity brokering & federation
One relationship instead of every possible pair
Four identity providers and five applications is not nine integrations. Left alone it becomes twenty, each with its own certificate expiry, its own attribute quirk, and its own person who understood it.
The arithmetic
It grows with the product, not the sum
Each connection on its own is a morning's work. What makes federation expensive is that nobody ever adds just one.
Direct federationproviders × applicationsn × m
Through a brokerproviders + applicationsn + m
The difference is not efficiency. It is whether adding the eleventh application is a decision or a project.
Where the cost actually shows up
Rarely at the first integration. Always at the twentieth.
You do not control the other side
Partner and customer providers rotate certificates and change attributes on their own schedule, without telling you. Every one of those is an outage in a system somebody else owns.
Nobody owns the pair
A direct federation belongs to whoever built it. Twenty of them belong to twenty half-remembered decisions, and the person who understood the attribute mapping has usually moved on.
How Monokee approaches it
Identity provider, service provider, or both at once
Translate between protocols
Accept an assertion in one standard and issue a token in another, so a SAML-only application can be reached by users from an OIDC-only provider without either side changing anything.
Map attributes in one place
What one side calls an email address, another calls a UPN and a third sends as an opaque identifier. The mapping is a set of rules somebody can read, not a property of each pairing.
Apply your policy in the middle
Authentication may have happened elsewhere. What it entitles someone to is still your decision — including asking for more when an upstream login is not enough.
Own the session
The broker holds the session with the application, which is what makes it possible to shorten, narrow or end access without depending on a provider you do not control.
Bring us the integration matrix
The one with providers down the side and applications across the top. It usually makes the case on its own.
Talk to an expert