service provider. The service provider, wishing to know the identity of the user, issues an authentication request to a SAML identity provider through the user agent. The identity provider is the one that provides the user credentials. The service provider trusts the user information from the identity provider to provide access to its services or resources. Emerging configurations Mobile devices as access credentials A newer variation of single-sign-on authentication has been developed using mobile devices as access credentials. Users' mobile devices can be used to automatically log them onto multiple systems, such as building-access-control systems and computer systems, through the use of authentication methods which include OpenID Connect and SAML, in conjunction with an X.509 ITU-T cryptography certificate used to identify the mobile device to an access server. A mobile device is "something you have," as opposed to a password which is "something you know," or biometrics (fingerprint, retinal scan, facial recognition, etc.) which is "something you are." Security experts recommend using at least two out of these three factors (multi-factor authentication) for best protection. See also Account pre-hijacking Central Authentication Service Identity management Identity management systems List of single sign-on implementations Password manager Security Assertion Markup Language Usability of web authentication systems References External links Single sign-on intro with diagrams Password authentication Federated identity Computer access control