SSO

Single sign-on (SSO) is an authentication mechanism that enables a user to access multiple applications with one set of credentials. By centralizing verification, SSO reduces password prompts and streamlines access across related systems. It is a principal feature of identity and access management (IAM) used in enterprises, cloud environments, and partner networks.

How it works: the user attempts to access a service (the service provider). The service redirects to an identity provider (IdP) that authenticates the user. Upon success, the IdP issues a token or assertion that the service trusts, granting access and establishing a session. Protocols include SAML, OAuth 2.0, and OpenID Connect.

Key components and standards: an identity provider and one or more service providers form a federation. Common protocols are SAML 2.0, OAuth 2.0, OpenID Connect, and WS-Federation. IdPs may be cloud-based or on-premises and often integrate with directory services such as Active Directory.

Benefits include improved user experience, reduced password fatigue, centralized access control, and easier user provisioning and offboarding. Risks involve a single point of failure or credential compromise at the IdP, token theft, phishing, and misconfiguration. Strong security practices, multi-factor authentication, and monitoring mitigate these concerns.

Deployment considerations include choosing cloud, on-premises, or hybrid models, configuring session lifetimes and token expiry, integrating with MFA, and maintaining audit logs for compliance. SSO is commonly paired with broader IAM features such as authorization and risk-based access.