An identity provider authenticates a subject and issues an identity assertion for another service, the relying party. In federated login, the application trusts specified assertions from a configured provider rather than collecting the user's password itself. The application still validates the assertion's signature, intended audience, freshness and relevant protocol state, and performs its own authorization. A provider account and an application account need not be identical records. Trust in the provider and correct protocol validation are assumptions of the federation, not consequences of the login button's appearance.
New to topics? Read the docs here!