Single sign-on (SSO) is an authentication scheme that lets a user log in once with one identity and then access many applications without entering passwords again.
How SSO works
A central identity provider (IdP) – such as Microsoft Entra ID, Okta, Google Workspace or Keycloak – verifies the user, ideally with MFA. Applications (service providers) trust the IdP and accept a signed assertion or token instead of their own password. Main protocols:
- SAML 2.0 – XML-based standard from 2005, common in enterprise web apps;
- OpenID Connect – identity layer on top of OAuth 2.0 (2014), used by “Sign in with Google/Apple” and modern apps;
- Kerberos – used inside Windows domains with Active Directory.
Why SSO matters for security
SSO reduces the number of passwords people must remember and reuse, makes it possible to enforce MFA and policies in one place, and lets companies revoke all access instantly when an employee leaves. On the other hand, the IdP becomes a single point of failure and a prime target: attackers who steal an SSO session or compromise the IdP get into everything. Techniques like “Golden SAML” – forging assertions with a stolen signing key – were used in the SolarWinds campaign, and the 2023 breach of Okta’s support system exposed customers’ session data. SSO also relies on correct implementation in each application.
Best practices
- Protect the IdP with phishing-resistant MFA and conditional access, especially for admins.
- Guard signing keys and certificates; monitor for new federation trusts and app registrations.
- Connect as many applications as possible to SSO and remove local accounts and shared passwords.
- Limit session lifetimes and bind sessions to managed devices.
