Single Sign-On (SSO)
What Is Single Sign-On?
Single Sign-On (SSO) is an authentication mechanism that allows users to log in once with a single set of credentials and gain access to multiple connected applications and systems without re-authenticating each one. Once authenticated through the identity provider, the user session is recognized across all applications integrated with the SSO system, eliminating the need to remember and enter separate usernames and passwords for each tool.
SSO is both a user experience improvement and a security control. It reduces password fatigue and the security risk that comes with it (password reuse, weak passwords for ‘less important’ systems), centralizes authentication management in a single identity provider, and provides a single point for enforcing strong authentication policies such as multi-factor authentication across all connected applications simultaneously.
How SSO Works
SSO relies on a trusted identity provider (IdP), such as Microsoft Entra ID, Okta, or Google Workspace, that authenticates the user and issues a token or assertion confirming their identity. When the user attempts to access a connected application (the service provider), that application redirects the authentication request to the IdP rather than asking for credentials directly. The IdP confirms the user’s authenticated session and returns a token to the application, granting access without the user entering credentials again.
SSO Protocols
SAML (Security Assertion Markup Language): an XML-based standard for exchanging authentication and authorization data between identity providers and service providers. SAML is widely used for enterprise SSO integrations, particularly with legacy SaaS applications.
OAuth 2.0 and OpenID Connect (OIDC): modern token-based protocols used for API authorization and identity federation. OIDC extends OAuth 2.0 to add user authentication, making it the preferred protocol for modern web and mobile SSO implementations.
SSO Security Considerations
SSO concentrates authentication into a single point, which is both its strength and its most significant security consideration. If the identity provider is compromised or the user’s SSO credentials are stolen, the attacker gains access to every application connected to the SSO system. This makes the identity provider’s security and the enforcement of multi-factor authentication on SSO logins critically important. The SSO credential must be the most protected credential in the user’s portfolio.
Key Takeaways
- SSO allows users to authenticate once and access multiple applications without re-entering credentials for each.
- It improves user experience, reduces password-related security risk, and centralizes authentication of policy enforcement.
- SAML is the standard for enterprise SSO with legacy applications; OIDC is the modern standard for web and mobile implementations.
- SSO concentrates authentication risk at the identity provider level, making MFA enforcement on SSO accounts critically important.
- Microsoft Entra ID, Okta, and Google Workspace are the most widely deployed enterprise SSO identity providers.