Web Single Sign-On: Understanding WS-Federation

In 2026, despite the utopian vision presented at identity conferences of a world dominated by modern authentication methods like Passkeys and OAuth 2.0, the reality for many enterprises is starkly different as they continue to rely on legacy systems such as WS-Federation (WS-Fed). These outdated systems, although cumbersome and challenging for modern developers to navigate, remain integral to the operation of large enterprises due to the prohibitive cost and risk associated with replacing them. WS-Fed, a part of the SOAP-based WS-* suite, plays a crucial role in identity management by transporting authentication tokens in environments where enterprises have yet to fully transition to more contemporary protocols like OIDC. The protocol primarily supports web-based single sign-on (SSO) through a process known as the Passive Requestor Profile, which utilizes browser-based HTTP redirects and form POSTs. The continued reliance on WS-Fed is driven by the need to maintain functionality in existing infrastructure while integrating modern identity providers, a strategy known as "Wrap and Adapt." This approach allows companies to enhance user experiences with modern security features like multi-factor authentication, while still utilizing their existing backend systems. Understanding WS-Fed, therefore, becomes essential for developers and identity architects who need to bridge the gap between new and old technologies, ensuring seamless operation of critical business applications.