Identity provider
An identity provider is a system that supplies verifiable information about a user's authentication and identity to applications that trust it.
The service an application trusts for sign-in
In a federated sign-in, the application relies on an identity provider to authenticate the user. The provider sends an assertion: a verifiable statement about the account and authentication. The application, called a relying party, validates that assertion before accepting it.
An OpenID Connect provider sends an ID token. Other federation protocols use different assertion formats. The trust relationship matters: an application must know which provider it accepts assertions from, rather than trusting any service that can produce a token.
Where the provider’s responsibility ends
The identity provider establishes who signed in. The application’s authorization rules still determine what that account can do. Giving an employee access to a benefits portal, for example, need not give them permission to edit everyone else’s benefits.
Account enrollment is another separate question. A successful sign-in does not, by itself, tell you how thoroughly someone’s real-world identity was checked when the account was created. That is the role of identity proofing.