The SSO platform verifies the credentials against its identity provider (IdP), which holds the user’s identity information. Sometimes, a browser-based user may start with this step.