With SAML, an Identity Provider (IP) is asked whether the user is authorized to access idgard. This IP is not part of idgard, but rather an external service that redirects the user to the login page. The IP is used by a company, e.g., TÜV, to perform authentications, e.g., for SSO. Commonly used IPs are Microsoft (with its Active Directory) or Google, Okta, etc.; basically any time you see Login with ....

During SSO, the IP delivers a response (assertion response) which indicates whether the user is authorized to access idgard.

For idgard it is important to know whether the IP was actually commissioned by a company (e.g., TÜV) in order to be able to check permissions and grant access. Enterprise Secret is therefore also used to ensure that the response was really sent by the commissioned IP and not by a malicious third-party. Enterprise Secret is used to encrypt and decrypt the assertion response.