Discovery service

When a user wants to access a protected resource or service, the discovery service provides a list of IdPs that the user can choose from. The user selects their home IdP and is then redirected to the IdP's login page to enter their credentials. Once the user has been authenticated by the IdP, they are redirected back to the discovery service, which then provides the user with access to the protected resource or service.

The purpose of a discovery service is to simplify the login process for users and to enable federated identity management, where multiple organizations can use a common set of authentication and authorization mechanisms to provide access to shared resources. By using a discovery service, users can access multiple services without having to remember separate usernames and passwords for each service, and service providers can rely on the user's home IdP to authenticate and authorize the user.