Single Sign-On (SSO)
An authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems.
Detailed Explanation
SSO improves user experience by reducing 'password fatigue' and improves security by centralizing authentication. When a user logs in via SSO, they are authenticated by a central 'Identity Provider' (IdP), which then issues tokens to the various applications (Service Providers). This is common in enterprise environments using protocols like SAML or OIDC.
Quick Summary
SSO lets users authenticate once with an identity provider and access many applications without logging in again. It's table stakes for enterprise software and a critical control point for security and offboarding.
Key Takeaways
- Common protocols: SAML 2.0 (enterprise legacy), OIDC (modern web/mobile), Kerberos (Windows/AD).
- Centralizing authentication centralizes risk, the IdP becomes a high-value target; protect it with MFA and conditional access.
- Offboarding is one click: disable the user at the IdP and access vanishes everywhere.
- SSO usually means session-based; a long IdP session can quietly grant access to dozens of downstream apps.
- SCIM often pairs with SSO to provision/deprovision user accounts automatically.
When to use it
- Enterprise B2B SaaS: customers require SAML or OIDC integration with Okta, Azure AD, or Google Workspace.
- Internal tools dashboard where employees should authenticate once per day.
- Customer-facing apps offering "Sign in with Google/Apple" as a low-friction signup path.
- Centralized audit logging, every login flows through the IdP.
Common Mistakes
- Charging extra for SSO (the "SSO tax"); enterprise buyers increasingly treat this as a security red flag.
- Allowing local password logins to coexist with SSO without admin opt-out, defeats centralized offboarding.
- Skipping signature validation on SAML assertions or OIDC tokens.
- Not implementing single logout, users "log out" of one app but stay signed in elsewhere.
Single Sign-On (SSO), Frequently Asked
SAML or OIDC?
OIDC for new projects, JSON-based, mobile-friendly, simpler to debug. SAML is still required when customers' IdPs only support it (still common in large enterprises). Most SaaS supports both.
Is SSO more or less secure than passwords per app?
More, if done right: one strong credential + MFA at the IdP beats dozens of weak per-app passwords, and offboarding actually works. But the IdP becomes a single point of failure, so it needs strong protection.