SECURITY

Home › Glossary › Security· 392 ·

SSO

ess-ess-ohnoun

Filed underSecurityWeb Development

In brief · quick answer

Single Sign-On (SSO) is an authentication method that allows users to log in once and access multiple applications without re-entering credentials. It uses centralized identity providers and protocols like SAML, OIDC, or OAuth.

§ 1 Definition

SSO is a session and user authentication service that permits a user to use one set of login credentials to access multiple independent applications. The core component is a centralized identity provider (IdP) that authenticates the user once and issues a token that is trusted by multiple service providers (applications). SSO reduces password fatigue, eliminates the need to manage multiple credentials, and centralizes authentication audit trails. Enterprise SSO commonly uses SAML 2.0 or OpenID Connect (OIDC). Consumer SSO often uses OAuth 2.0 with OIDC (e.g., 'Login with Google').

§ 2 How SSO Works

The user attempts to access an application (Service Provider). The app redirects them to the Identity Provider (IdP) for authentication. The user authenticates (username/password, MFA, passkey). The IdP generates a signed token or assertion (SAML response or OIDC ID token) and sends it back to the app. The app validates the token and creates a local session. Subsequent visits to other apps in the same SSO ecosystem also redirect to the IdP, but since the user already has a session at the IdP, they are redirected back without re-authenticating.

§ 3 SSO Protocols

SAML 2.0 (Security Assertion Markup Language): XML-based, widely used in enterprise and government. Exchanges XML assertions between IdP and Service Provider. OpenID Connect (OIDC): Modern, JSON-based, built on OAuth 2.0. Simpler to implement, more web-friendly. Kerberos: Legacy enterprise protocol, still used in Windows Active Directory environments.

§ 4 SSO Risks and Considerations

SSO is a single point of failure. If the IdP is down, users cannot access any application. If the IdP is compromised, all applications are compromised. SSO with MFA is strongly recommended to mitigate credential theft risks. SSO also introduces a logout challenge: closing one app's session does not necessarily log the user out of the IdP or other apps (Single Logout/SLO protocols exist but are inconsistently implemented).

§ 5 Note

SAML is mature but XML-heavy. OIDC is the preferred protocol for modern web and mobile applications. Many identity providers (Okta, Auth0, Azure AD, Keycloak) support both.

§ 6 Common questions

Q. Is SSO the same as OAuth?: A. No. SSO is an authentication concept (one login, many apps). OAuth 2.0 is an authorization protocol. SSO is often implemented using OIDC (which is built on OAuth 2.0) or SAML 2.0.
Q. Does SSO improve security?: A. Yes and no. SSO centralizes authentication, which means stronger, consistent authentication policies (like MFA) can be enforced everywhere. But it also creates a single point of attack. Compromise of the IdP compromises all connected apps.
Q. What is SAML? Is it still relevant?: A. SAML 2.0 is an XML-based SSO protocol. It is still widely used in enterprise, government, and education. OIDC is generally preferred for modern web/mobile apps, but SAML remains important for legacy integrations.

Key takeaways

SSO lets users authenticate once and access multiple apps.
SAML 2.0 (enterprise) and OIDC (modern) are the primary protocols.
SSO is a single point of failure; combine with MFA.
Single Logout (SLO) is important but often poorly implemented.

How Atomic Glue helps

Atomic Glue designs and deploys SSO architectures using OIDC and SAML, integrates with major IdPs, and enforces MFA enforcement at the SSO level. Get in touch.

Get in touch

# SSO

Category: Security (also: Web Development)

Author: Atomic Glue Security Team

## Definition

## How SSO Works

## SSO Protocols

**SAML 2.0** (Security Assertion Markup Language): XML-based, widely used in enterprise and government. Exchanges XML assertions between IdP and Service Provider. **OpenID Connect (OIDC)**: Modern, JSON-based, built on OAuth 2.0. Simpler to implement, more web-friendly. **Kerberos**: Legacy enterprise protocol, still used in Windows Active Directory environments.

## SSO Risks and Considerations

SSO is a single point of failure. If the IdP is down, users cannot access any application. If the IdP is compromised, all applications are compromised. **SSO with MFA** is strongly recommended to mitigate credential theft risks. SSO also introduces a logout challenge: closing one app's session does not necessarily log the user out of the IdP or other apps (Single Logout/SLO protocols exist but are inconsistently implemented).

## Note

SAML is mature but XML-heavy. OIDC is the preferred protocol for modern web and mobile applications. Many identity providers (Okta, Auth0, Azure AD, Keycloak) support both.

## Common questions

Q: Is SSO the same as OAuth?

A: No. SSO is an authentication concept (one login, many apps). OAuth 2.0 is an authorization protocol. SSO is often implemented using OIDC (which is built on OAuth 2.0) or SAML 2.0.

Q: Does SSO improve security?

A: Yes and no. SSO centralizes authentication, which means stronger, consistent authentication policies (like MFA) can be enforced everywhere. But it also creates a single point of attack. Compromise of the IdP compromises all connected apps.

Q: What is SAML? Is it still relevant?

A: SAML 2.0 is an XML-based SSO protocol. It is still widely used in enterprise, government, and education. OIDC is generally preferred for modern web/mobile apps, but SAML remains important for legacy integrations.

## Key takeaways

SSO lets users authenticate once and access multiple apps.
SAML 2.0 (enterprise) and OIDC (modern) are the primary protocols.
SSO is a single point of failure; combine with MFA.
Single Logout (SLO) is important but often poorly implemented.

## Related entries

Last updated December 2024. Permalink: atomicglue.co/glossary/sso