An identity assertion is a signed statement that says an identity check has already been performed by a trusted system. In federated authentication, it tells a service provider that a user or service was verified elsewhere, so the relying application can grant access without redoing the login. Assertions are common in SSO and federation protocols, where their signature, issuer, audience, and lifetime must be validated carefully.
Identity assertions matter because they can become a shortcut into many connected systems. If an attacker steals, forges, or replays a valid assertion, they may impersonate a legitimate user across applications and APIs. Defenders reduce this risk by protecting signing keys, enforcing strict validation, limiting token lifetime, and logging issuance and use for anomaly detection. In practice, the assertion is one of the core trust objects in the identity path.