There are multiple mechanisms (some now defunct) that allow me to access service A (the Relying Party / RP) using a token granted by service B (the Identity Provider / IdP). Typically these replace a username-and-password login. Examples of IdP protocols include:

* OpenID 2.0
* OpenID Connect
* IndieAuth
* Mozilla Persona
* Portier
* ...and obviously Google Sign-In and Facebook Login

What stops the IdP from gaining access to my account on the RP? Surely a bad actor with sysadmin privileges at the IdP can:

1. Make a login attempt at service A
2. ...initiating a token request from A to B
3. Generate a token at service B (without needing my credentials)
4. ...return the valid response to A
5. Now access my account at A

I'm asking a general question, but as a concrete *example*, what stops a bad Facebook admin from posting Stack Exchange questions under my name?

Rough sketch:

[![Bad admin generates the authorization code](https://i.stack.imgur.com/x8TsZ.png)](https://i.stack.imgur.com/x8TsZ.png)

(Sketch adapted from <https://developers.google.com/identity/protocols/OAuth2> but note that the referenced protocol is just an *example*.)