, ▁identity ▁feder ation ▁is ▁established ▁between ▁two ▁organizations ▁by ▁establish ing ▁trust ▁between ▁two ▁security ▁real ms . ▁A ▁feder ation ▁server ▁on ▁one ▁side ▁( the ▁Account s ▁side ) ▁authentic ates ▁the ▁user ▁through ▁the ▁standard ▁means ▁in ▁Active ▁Directory ▁Domain ▁Services ▁and ▁then ▁issues ▁a ▁token ▁containing ▁a ▁series ▁of ▁claims ▁about ▁the ▁user , ▁including ▁its ▁identity . ▁On ▁the ▁other ▁side , ▁the ▁Resources ▁side , ▁another ▁feder ation ▁server ▁valid ates ▁the ▁token ▁and ▁issues ▁another ▁token ▁for ▁the ▁local ▁servers ▁to ▁accept ▁the ▁claimed ▁identity . ▁This ▁allows ▁a ▁system ▁to ▁provide ▁controlled ▁access ▁to ▁its ▁resources ▁or ▁services ▁to ▁a ▁user ▁that ▁belongs ▁to ▁another ▁security ▁real m ▁without ▁requiring ▁the ▁user ▁to ▁authentic ate ▁directly ▁to ▁the ▁system ▁and ▁without ▁the ▁two ▁systems ▁sharing ▁a ▁database ▁of ▁user ▁ident ities ▁or ▁passwords . ▁ ▁In ▁practice ▁a ▁user ▁might ▁typically ▁perce ive ▁this ▁approach ▁as ▁follows : ▁ ▁The ▁user ▁logs ▁into ▁their ▁local ▁PC ▁( as ▁they ▁typically ▁would ▁when ▁comm encing ▁work ▁in ▁the ▁morning ). ▁ ▁The ▁user ▁needs ▁to ▁obtain ▁information ▁from ▁a ▁partner ▁company ' s ▁extr an et ▁website , ▁for ▁example ▁to ▁obtain ▁pr icing ▁or ▁product ▁details . ▁ ▁The ▁user ▁navig ates ▁to ▁the ▁partner - company ▁extr an et ▁site , ▁for ▁example : ▁http :// example . com . ▁ ▁The ▁partner ▁website ▁now ▁does ▁not ▁require ▁any ▁password ▁to ▁be ▁typed ▁in ; ▁instead , ▁the ▁user ▁credentials ▁are ▁passed ▁to