security token service (SSO) (STS)

The Security Token Service(STS) is an instance within an authentication system that the client accesses with a Request Security Token( RST) when it makes a request.

The concept is that the client wants to obtain authentication from the service provider via the Security Token Service. After successful authentication of the client, the Security Token Service generates a symmetric key, which can only be used for a short time, and a SAML token with the user name and some attributes requested by the service provider.

The public key transmitted by the service provider is extended by the symmetric key. The Security Token Service verifies the token by providing it with a digitalsignature. The client receives the token with the symmetric key and can use it to create its signature.