SingleSignOn

SingleSignOn, commonly abbreviated SSO, is an authentication approach that allows a user to log in once and gain access to multiple independent applications and services without re-entering credentials for each one. In this model, authentication is centralized through an identity provider (IdP) that vouches for user identity to relying parties (service providers).

When a user attempts to access a protected application, the application redirects the user to the IdP for authentication. After successful login, the IdP issues a security token or assertion that the application accepts. The user then has a single session across all participating apps, with the tokens or session cookies conferring access.

Common standards and technologies used in SingleSignOn include SAML (XML-based), OAuth 2.0 with OpenID Connect, and other federation protocols. The IdP and service providers establish trust through metadata and tokens, enabling seamless sign-in while allowing central policy enforcement and revocation.

Benefits include improved user experience through fewer logins, reduced password fatigue, centralized access management, easier rollout of security controls such as multi-factor authentication, and streamlined user provisioning and deprovisioning across applications.

Security considerations include the concentration of authentication risk in the IdP, the need for strong authentication and device trust, and robust session management. Organizations should monitor for token theft, implement MFA, enforce fine-grained authorization, and plan for IdP availability and disaster recovery.

SSO can be deployed with cloud-based IdPs or with on-premises or hybrid configurations. It is commonly used in enterprise environments to enable access to SaaS apps, internal portals, and customer identity management scenarios.