What Single Sign-On Is and How It Works
Summary
An overview of single sign-on (SSO), explaining its authentication flow, common protocols, benefits and risks, and considerations for implementing it securely, including MFA, session timeouts, and least privilege.
Key points
- SSO lets users authenticate once through an identity provider and access multiple applications using a signed token.
- SAML, OIDC, Kerberos, and password-based SSO are among the approaches described; OAuth is primarily an authorization protocol.
- Centralized authentication can support stronger password policies, MFA, access management, and faster revocation of departing employees’ access.
- Compromise or outage of the identity provider can affect all connected applications, and stolen SSO credentials can expose multiple accounts.
- The article recommends assessing infrastructure and security needs, using MFA, setting strict session timeouts, and applying least privilege.
Article Details
- Topic
- Single sign-on (SSO): how it works, common protocols, benefits, implementation considerations, and security risks
Products
KerberosKerberos is a powerful network authentication protocol.Microsoft Active DirectoryThese tickets are then used to prove identity to network services, so it’s an ultra-secure protocol commonly found in on-premise enterprise environments like Microsoft Active Directory.OAuth 2.0This token, often based on standards such as Security Assertion Markup Language (SAML) or OAuth 2.0, acts like a digital key, giving the user access to the requested application without making them re-enter theirOpenID Connect (OIDC)OpenID Connect (OIDC) works with the OAuth 2.0 protocol.Security Assertion Markup Language (SAML)This token, often based on standards such as Security Assertion Markup Language (SAML) or OAuth 2.0, acts like a digital key, giving the user access to the requested application without making them re-enter their