Single Sign-On (SSO)
Single sign-on (SSO) is an authentication process in which one account and its authenticators are used to access multiple applications, generally implemented with a federation protocol.
Updated
Overview
SSO centralizes the management and control of authentication and access across multiple systems and identity providers. Users no longer need to maintain separate identities in internal and external directories, applications, and platforms, which removes the need for local identities on each asset.
SSO services use protocols such as SAML or OpenID Connect (OIDC). SAML exchanges authentication and authorization data between identity providers and service providers, and browser-based SSO is one of its most common uses. OIDC is a thin layer on top of OAuth 2.0 that adds login and profile information about the person who is logged in.
With SSO, users need to remember one strong passphrase, and the migration to strong MFA becomes easier. It also cuts the number of locally provisioned accounts on individual systems, which are hard to maintain and on which security event monitoring is ineffective, and gives administrators more central visibility and control over accounts.
SSO concentrates risk. If SSO fails, access to all related systems is lost, so deployments need a high availability design. Attackers target SSO functions to reach protected resources across an organization, and SSO without a good MFA foundation and secure design increases the damage from attacks such as password cracking and authenticator hijacking.
Similar Terms
2 termsMFA
SSO centralizes authentication so that one account reaches many applications. MFA strengthens the sign-in itself by requiring factors from more than one category. CISA and NSA guidance recommends implementing MFA as part of an enterprise SSO solution.
IAM
IAM is the wider framework of processes, policies, and technologies for managing digital identities. Identity federation and SSO is one of the areas it covers, alongside identity governance, environmental hardening, MFA, and auditing and monitoring.
Frequently Asked Questions
What does SSO stand for?→
SSO stands for single sign-on.
Is SSO secure?→
SSO centralizes authentication, which helps threat detection and response but also makes it an attack target and a single point of failure. If SSO fails, access to all related systems is lost. Pairing SSO with strong MFA, secure design choices, and a high availability design reduces these risks.
What is the difference between SAML and OIDC?→
SAML exchanges authentication and authorization data between identity providers and service providers. OIDC is a thin layer on top of OAuth 2.0 that adds login and profile information. CISA and NSA guidance describes the OIDC authorization code flow as a better choice than SAML for security, because codes are exchanged for tokens on back channels.
Related
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.