Skip to content
ENExplore Calculators

Federation Trust Calculator

Compare full-mesh federation against a hub broker: trusts to maintain, certificate rotations and metadata refresh load.

About Federation Trust Calculator

In a direct federation each identity provider must be configured at each service provider, so the work is the product of the two. A broker turns that product into a sum: every party trusts the hub only, and the hub handles the translation between protocols and claim formats. Trust count is really a maintenance count — every trust carries a certificate that expires and metadata that drifts, and an unrotated certificate takes the login down at a moment nobody chose.

Formulas

Federation Trust

A full mesh between N parties needs N × (N − 1) directed trusts, while a hub needs only 2N — one inbound and one outbound per party.

N
Total federation participants — identity providers plus service providers
N × (N − 1)
Directed trust relationships in a full mesh
2N
Trusts when everything terminates on a broker

Certificate rotation workload

certificate rotations per year = trusts × 12 ÷ signing certificate lifetime in months.

signing certificate
Each trust pins the peer's signing certificate and must be updated before it expires

Worked example

With the default values below, Federation Trust Calculator returns Trusts to Maintain of 76. Change any input above and every figure here is recalculated in your browser.

Inputs used

Identity providersaccepts 1–1,000 IdPs
8 IdPs
Service providers or relying partiesaccepts 1–10,000 SPs
30 SPs
Route through a federation hub or broker
Yes
Signing certificate lifetimeaccepts 1–60 months
12 months
Metadata refresh intervalaccepts 1–720 hours
24 hours

Results

Trusts to Maintain
76
Trusts in a Direct Mesh
240
Trusts Through a Hub
76
Peer Pairs if Every Party Trusted Every Other
1,406
Trusts Avoided by the Hub
164
Reduction vs Direct Mesh
68.3%
Certificate Rotations per Year
76.0
Metadata Fetches per Day
76

Step by step

  1. 1Values used
  2. 2Federation Trust
  3. 3Certificate rotation workload
  4. 4Trusts to Maintain= 76
  5. 5Trusts in a Direct Mesh= 240
  6. 6Trusts Through a Hub= 76
  7. 7Peer Pairs if Every Party Trusted Every Other= 1,406
  8. 8Trusts Avoided by the Hub= 164
  9. 9Reduction vs Direct Mesh= 68.3

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Federation Trust calculated?

A full mesh between N parties needs N × (N − 1) directed trusts, while a hub needs only 2N — one inbound and one outbound per party. In a direct federation each identity provider must be configured at each service provider, so the work is the product of the two. A broker turns that product into a sum: every party trusts the hub only, and the hub handles the translation between protocols and claim formats.

Why does Federation Trust matter?

Trust count is really a maintenance count — every trust carries a certificate that expires and metadata that drifts, and an unrotated certificate takes the login down at a moment nobody chose.

What values do I need to enter?

This calculator takes 5 inputs: Identity providers, Service providers or relying parties, Route through a federation hub or broker, Signing certificate lifetime, Metadata refresh interval. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

When is a federation hub worth the extra hop?

Once the product of identity providers and service providers exceeds roughly the number you would willingly renew certificates for by hand — in practice a few dozen. A hub also normalises protocols, so SAML-only applications can consume OIDC identity providers without each side being upgraded.

What is the downside of a hub?

It is a single point of failure and a single point of compromise: everything authenticates through it, so it needs the availability and hardening of a tier-zero system. It also flattens the audit trail, since service providers see the hub as the issuer rather than the original identity provider unless claims are passed through.

Related Calculators

Federation Trust Calculator – Calculate Trusts to Maintain