Compare full-mesh federation against a hub broker: trusts to maintain, certificate rotations and metadata refresh load.
In a direct federation each identity provider must be configured at each service provider, so the work is the product of the two. A broker turns that product into a sum: every party trusts the hub only, and the hub handles the translation between protocols and claim formats. Trust count is really a maintenance count — every trust carries a certificate that expires and metadata that drifts, and an unrotated certificate takes the login down at a moment nobody chose.
Federation Trust
A full mesh between N parties needs N × (N − 1) directed trusts, while a hub needs only 2N — one inbound and one outbound per party.
Certificate rotation workload
certificate rotations per year = trusts × 12 ÷ signing certificate lifetime in months.
A full mesh between N parties needs N × (N − 1) directed trusts, while a hub needs only 2N — one inbound and one outbound per party. In a direct federation each identity provider must be configured at each service provider, so the work is the product of the two. A broker turns that product into a sum: every party trusts the hub only, and the hub handles the translation between protocols and claim formats.
Trust count is really a maintenance count — every trust carries a certificate that expires and metadata that drifts, and an unrotated certificate takes the login down at a moment nobody chose.
This calculator takes 5 inputs: Identity providers, Service providers or relying parties, Route through a federation hub or broker, Signing certificate lifetime, Metadata refresh interval. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Once the product of identity providers and service providers exceeds roughly the number you would willingly renew certificates for by hand — in practice a few dozen. A hub also normalises protocols, so SAML-only applications can consume OIDC identity providers without each side being upgraded.
It is a single point of failure and a single point of compromise: everything authenticates through it, so it needs the availability and hardening of a tier-zero system. It also flattens the audit trail, since service providers see the hub as the issuer rather than the original identity provider unless claims are passed through.