Federation Trust Calculator

A full mesh between N parties needs N × (N − 1) directed trusts, while a hub needs only 2N — one inbound and one outbound per party. In a direct federation each identity provider must be configured at each service provider, so the work is the product of the two. A broker turns that product into a sum: every party trusts the hub only, and the hub handles the translation between protocols and claim formats.

Trust count is really a maintenance count — every trust carries a certificate that expires and metadata that drifts, and an unrotated certificate takes the login down at a moment nobody chose.

This calculator takes 5 inputs: Identity providers, Service providers or relying parties, Route through a federation hub or broker, Signing certificate lifetime, Metadata refresh interval. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Once the product of identity providers and service providers exceeds roughly the number you would willingly renew certificates for by hand — in practice a few dozen. A hub also normalises protocols, so SAML-only applications can consume OIDC identity providers without each side being upgraded.

It is a single point of failure and a single point of compromise: everything authenticates through it, so it needs the availability and hardening of a tier-zero system. It also flattens the audit trail, since service providers see the hub as the issuer rather than the original identity provider unless claims are passed through.