What Is Single Sign-On Authentication (SSO) And How Does It Work? (2024)

Single Sign-On (SSO) authentication is now required more than ever. Nowadays, almost every website requires some form of authentication to access its features and content. With the number of websites and services rising, a centralized login system has become a necessity. In this post, we will study how SSO authentication is implemented for the web. Read on!

Federated Identity Glossary

The concept of a centralized or linked electronic identity is known as federated identity. Federated identity systems handle several concerns:

  • Authentication
  • Authorization
  • User attributes exchange
  • User management

The authentication aspect deals with validating user credentials and establishing the identity of the user.

Authorization is related to access restrictions (e.g., is the user allowed to access X resource?).

The attributes exchange aspect deals with data sharing across different user management systems. For instance, fields such as "real name" may be present in multiple systems. A federated identity system prevents data duplication by linking the related attributes.

Lastly, user management is related to the administration (creation, deletion, update) of user accounts. A federated identity system usually provides the means for administrators (or users) to handle accounts across domains or subsystems.

SSO is strictly related to the authentication part of a federated identity system. Its only concern is establishing the identity of the user and then sharing that information with each subsystem that requires the data. Below, we focus on this crucial aspect of a federated identity system.

What Is Single Sign-On Authentication (SSO) And How Does It Work? (1)

Single Sign-On (SSO) Authentication

Sooner or later web development teams face one problem: you have developed an application at domain X and now you want your new deployment at domain Y to use the same login information as the other domain. In fact, you want more: you want users who are already logged-in at domain X to be already logged-in at domain Y. This is what SSO is all about.

What Is Single Sign-On Authentication (SSO) And How Does It Work? (2)

The obvious solution to this problem is to share session information across different domains. However, for security reasons, browsers enforce a policy known as the same origin policy. This policy dictates that cookies (and other locally stored data) can only be accessed by its creator (i.e. the domain that originally requested the data to be stored). In other words, domain X cannot access cookies from domain Y or vice versa. This is what SSO solutions solve in one way or the other: sharing session information across different domains.

What Is Single Sign-On Authentication (SSO) And How Does It Work? (3)

Different SSO protocols share session information in different ways, but the essential concept is the same: there is a central domain, through which authentication is performed, and then the session is shared with other domains in some way.

For instance, the central domain may generate a signed JSON Web Token (JWT), which may be encrypted using JSON Web Encryption (JWE). This token may then be passed to the client and used by the authentication domain as well as any other domains. The token can be passed to the original domain by a redirect and it contains all the information needed to identify the user for the domain requiring authentication. As the token is signed, it cannot be modified in any way by the client.

What Is Single Sign-On Authentication (SSO) And How Does It Work? (4)

Whenever users go to a domain that requires authentication, they are redirected to the authentication domain. As users are already logged-in at that domain, they can be immediately redirected to the original domain with the necessary authentication token.

What Is Single Sign-On Authentication (SSO) And How Does It Work? (5)

SSO Authentication with Auth0

If you have been reading about SSO online, you have probably found that there are many different implementations: OpenID Connect, Facebook Connect, SAML, Microsoft Account (formerly known as Passport), etc. Our advice is to choose whatever is simplest for your development efforts. For instance, SAML is deeply entrenched in enterprise developments, so in some cases, it will make sense to pick that. If you think you will need to integrate your development with more than one alternative, don't despair: there are frameworks that allow interoperability between different SSO solutions. In fact, that's one of the things we do at Auth0.

Try out Auth0 authentication for free.Get started →

You can go and check our docs on Single Sign-On and the Auth0 SSO samples.

If you remember the Typical SSO Scenario diagram we saw earlier, you can see how Auth0 comes to play in the next diagram:

What Is Single Sign-On Authentication (SSO) And How Does It Work? (6)

In this case, Auth0 is the Authentication Server and it works as a bridge between different SSO frameworks.

For further information, we invite you to learn more about SSO with our free whitepaper.

Download the Whitepaper

What Is Single Sign-On Authentication (SSO) And How Does It Work? (7)

Conclusion

Single Sign-On authentication is here to stay. Decentralized systems are becoming more and more common and authentication is an essential aspect of all of them. SSO solves a big problem: how to manage the increasing number of users across a whole ecosystem of applications and services. Frameworks such as OpenID Connect and services such as the one we provide at Auth0 make integrating Single Sign-On into your new or existing applications much easier. If you are implementing authentication for a new application or service, consider integrating SSO from the get-go.

What Is Single Sign-On Authentication (SSO) And How Does It Work? (8)

What Is Single Sign-On Authentication (SSO) And How Does It Work? (2024)

FAQs

What Is Single Sign-On Authentication (SSO) And How Does It Work? ›

Single sign-on (SSO) is an authentication method that enables users to securely authenticate with multiple applications and websites by using just one set of credentials.

What is single sign-on SSO and how does it work? ›

Single sign-on (SSO) is an identification method that enables users to log in to multiple applications and websites with one set of credentials. SSO streamlines the authentication process for users.

What is an example of a SSO? ›

Step-By-Step Example of a Single Sign-On Process

The user tries to access an application (Service Provider) for the first time. The Service Provider redirects the user to the SSO identity provider (IdP) for authentication. The user enters a username and password, and the IdP verifies the credentials.

What are the benefits of using a single sign-on SSO authentication service? ›

SSO reduces the number of attack surfaces because users only log in once each day and only use one set of credentials. Reducing login to one set of credentials improves enterprise security. When employees have to use separate passwords for each app, they usually don't.

What is the difference between authentication and single sign-on? ›

Authentication: process of an entity (the Principal) proving its identity to another entity (the System). Single Sign On (SSO): characteristic of an authentication mechanism that relates to the user's identity being used to provide access across multiple Service Providers.

What is a major risk of using single sign-on SSO? ›

Little Control once Access is Granted

If a user successfully logs in via SSO and falls prey to a phishing attack, there is not always a simple solution. The attacker gets access to all the endpoints of the external applications within the cloud that the user is provisioned for.

Does SSO require a password? ›

Single sign-on (SSO) is a technology which combines several different application login screens into one. With SSO, a user only has to enter their login credentials (username, password, etc.) one time on a single page to access all of their SaaS applications.

Is SSO basic authentication? ›

Single sign-on (SSO) is a session and user authentication service that permits a user to use one set of login credentials -- for example, a username and password -- to access multiple applications. SSO is used by organizations of all sizes and individuals to ease the management of multiple credentials.

How do you implement an SSO? ›

Implementing SSO In 5 Steps
  1. Map Out The Applications You Want to Connect to SSO. Identify which applications should be part of your SSO structure. ...
  2. Integrate With Identity Provider (IdP) ...
  3. Verify The Data in Your Identity Directory. ...
  4. Evaluate User Privileges. ...
  5. Ensure The SSO System is Highly Available Secure.

Is Google an example of SSO? ›

You can configure your Cloud Identity or Google Workspace account to use single sign-on (SSO). When you enable SSO, users aren't prompted to enter a password when they try to access Google services. Instead, they are redirected to an external identity provider (IdP) to authenticate.

What is a disadvantage of SSO? ›

Single Sign On Disadvantages

Using a single password increases the chances of password vulnerability. Reduces the load of memorising several passwords. When SSO fails, access to all related systems is lost.

What is the difference between SSO and normal login? ›

Improved User Experience: SSO simplifies the login process for users. Instead of remembering numerous usernames and passwords, users only need to remember a single set of credentials. Enhanced Security: SSO reduces the risk of password fatigue, where users reuse the same password across multiple sites.

What is the difference between same sign-on and single sign-on? ›

Single sign-on systems require a one-time authentication from the user. Once logged in, the user can access other web applications and services without re-authenticating themselves. Meanwhile, same sign-on requires the user to repeat the login process each time with the same authentication credentials.

What is SSO and how does it work? ›

A single sign-on solution can simplify username and password management for both users and administrators. Users no longer have to keep track of different sets of credentials and can simply remember a single more complex password. SSO often enables users to just get access to their applications much faster.

What are two examples of common single sign-on authentication configurations? ›

Kerberos and smart card setups are common single sign-on configurations.

What is an example of single authentication? ›

Single-factor authentication is the simplest form of authentication method. With SFA, a person matches one credential to verify himself or herself online. The most popular example of this would be a password (credential) to a username.

What happens if single sign-on is enabled? ›

If single sign-on is enabled, it is strongly recommended that SSL communication be configured for the repository. Desktop client applications, such as Deployment Manager, create a Java subject and then establishes a GSS session with the repository using the subject context.

What are the advantages and disadvantages of single sign-on? ›

Disadvantages of Single Sign On (SSO):
SSO AdvantagesSingle Sign On Disadvantages
Reduces the load of memorising several passwords.When SSO fails, access to all related systems is lost.
Easy to implement and connect to new data sources.Increased risk of identity spoofing and phishing in user-external accesses.
1 more row

What is the benefit of using single sign-on SSO printing is? ›

HP PrinterOn Enterprise - What is SSO (Single Sign On)?

SSO advantages include: Eliminates credential re-authentication and help desk requests; thus, improving productivity. Streamlines local and remote application and desktop workflow. Minimizes phishing.

What's the difference between single sign-on SSO and social sign on answer? ›

The main difference between SSO (Single Sign-On) and social login is that SSO allows users to log in to multiple applications with a single set of credentials. In contrast, social login allows users to log in to one application using their social media account credentials.

References

Top Articles
Latest Posts
Article information

Author: Ms. Lucile Johns

Last Updated:

Views: 6201

Rating: 4 / 5 (41 voted)

Reviews: 88% of readers found this page helpful

Author information

Name: Ms. Lucile Johns

Birthday: 1999-11-16

Address: Suite 237 56046 Walsh Coves, West Enid, VT 46557

Phone: +59115435987187

Job: Education Supervisor

Hobby: Genealogy, Stone skipping, Skydiving, Nordic skating, Couponing, Coloring, Gardening

Introduction: My name is Ms. Lucile Johns, I am a successful, friendly, friendly, homely, adventurous, handsome, delightful person who loves writing and wants to share my knowledge and understanding with you.