What is Single-Sign On (SSO) and how does it work? - Auth0 (2024)

Single-Sign On (SSO) describes an identity solution that allows multiple applications to use the same authentication session, so avoiding repetitive credential entry. SSO implementations are often adopted by companies in the enterprise world as part of their strategy to secure access to important resources. With the advent of cloud computing and the boom of Software as a Service (SaaS), companies all around the world are increasing their focus on access management strategies that can enhance both security and the user experience; implementing SSO can deliver on both aspects.

From the security perspective, one benefit introduced by Single-Sign On is that, because it reduces the number of credentials required to sign into multiple services to a single credential, there are fewer credentials to be lost or stolen. In addition, multi-factor authentication (MFA), or two-factor authentication (2fA) is more likely to be enforced to protect that single, powerful, credential.

From the end-user perspective, leveraging an Identity Provider (IdP) system capable of supporting SSO enhances the user experience because it drastically lowers credential entry fatigue. Additionally, using SSO means that the burden of remembering credentials for, potentially, dozens of accounts is removed.

A beneficial side-effect of adopting SSO solutions is that the number of help desk calls related to password reset activities also decreases.

How does Single-Sign On Work?

Implementing Single-Sign On usually consists of defining a central service that applications rely on when a user logs in. In this approach, if an unauthenticated user requests an application that requires identity information, the app in question redirects the user to the central service. On this server, the user then authenticates and gets redirected back to the original application with identity information. There, they can move on and achieve the initial goals they had when the authentication request was triggered.

After a while, if that same user moves onto another application that also requires identity information and that relies on the same central service to perform user authentication, the second application can leverage the session that the user initiated while signing in to the first application.

A good example that can help illustrate how SSO works is Google and its different services. For example, when you try to access Gmail without being authenticated, Google redirects you to a central service that is hosted at accounts.google.com. There, you will see a sign-in form where you will have to input your user credentials. If the authentication process is successful, then Google redirects you to Gmail, where you gain access to your email account. Then, after authenticating through this central service, if you head to another service (like Youtube, for example), you will see that you are automatically signed in.

What is Single-Sign On (SSO) and how does it work? - Auth0 (1)

The following diagram gives more details on how a SSO authentication process works.

Assuming the user wants to access domain1.com, upon browsing to this domain they are redirected to the authentication server, domain3.com, where they authenticate. Upon successful authentication, domain3 stores a session cookie which is used for the SSO record. It then redirects the browser back to domain1 with an artifact that domain1.com can exchange for a token that may be used to prove the user’s identity for subsequent access to domain1’s services.

When the user (in the same session) accesses domain2.com, domain2 redirects to domain3 for authentication. However, because domain3 has a record that the user has a login session (via the cookie) it doesn’t require the user to login interactively, and instead redirects the browser back to domain2.com with an appropriate authentication artifact, as before.

Note that the SSO session valid period is determined by the authentication server (domain3) and may exist simply as long as the browser session, or for a specific period, from hours to weeks, depending on the security policy and user experience requirements.

This is the essence of SSO, as with Google and others. The protocol between the authentication server and the client applications will, typically, be SAML 2.0, OpenID Connect, Kerberos or other authentication protocol that supports SSO.

What is Single-Sign On (SSO) and how does it work? - Auth0 (2)

How to Implement Single-Sign On with Auth0

Just like with many other authentication and authorization features, using Auth0 to implement Single-Sign On is extremely easy. If you are already using Auth0 to secure your applications, SSO is already available for you automatically. For instance, if you have two or more applications using the same Auth0 account, you will notice that users that sign in to one, they will be transparently signed into the other. You don't have to do anything special on these applications to take advantage of the SSO session.

Another useful aspect of using Auth0 to enable Single-Sign On in your applications is in having a single point of control over access to resources, reducing IT resource demands.

If you want to learn more about Auth0, how it helps you implement Single-Sign On, and how to secure your apps with it, you can refer to the docs.

Want to learn more?

Keep reading at our Intro to IAM page to explore more topics around Identity and Access Management.

What is Single-Sign On (SSO) and how does it work? - Auth0 (2024)

FAQs

What is Single-Sign On (SSO) and how does it work? - Auth0? ›

Single Sign-on (SSO) occurs when a user logs in to one application and is then signed in to other applications automatically, regardless of the platform, technology, or domain the user is using.

What is single sign-on SSO and how does it work? ›

Single sign-on (SSO) is an identification method that enables users to log in to multiple applications and websites with one set of credentials. SSO streamlines the authentication process for users.

What are the benefits of using a single sign-on SSO authentication service? ›

SSO reduces the number of attack surfaces because users only log in once each day and only use one set of credentials. Reducing login to one set of credentials improves enterprise security. When employees have to use separate passwords for each app, they usually don't.

What is the difference between authentication and single sign-on? ›

Authentication: process of an entity (the Principal) proving its identity to another entity (the System). Single Sign On (SSO): characteristic of an authentication mechanism that relates to the user's identity being used to provide access across multiple Service Providers.

What is the difference between single sign-on and single identity? ›

While you may often encounter SSO and FIM mentioned together, it's important to note they aren't interchangeable terms. Single sign-on grants access to applications and resources within a single domain, whereas federated identity management enables single sign-on across multiple domains or organizations.

How does SSO work in Auth0? ›

SSO on subsequent logins

Auth0 checks to see whether there is an existing SSO cookie. Auth0 finds the SSO cookie, and if necessary, updates it. No login screen is shown. Auth0 redirects the user to your application, returning an ID Token that contains identity information for the user.

What is a major risk of using single sign-on SSO? ›

Little Control once Access is Granted

If a user successfully logs in via SSO and falls prey to a phishing attack, there is not always a simple solution. The attacker gets access to all the endpoints of the external applications within the cloud that the user is provisioned for.

What is a disadvantage of SSO? ›

Single Sign On Disadvantages

Using a single password increases the chances of password vulnerability. Reduces the load of memorising several passwords. When SSO fails, access to all related systems is lost.

What is an example of a single sign-on? ›

Step-By-Step Example of a Single Sign-On Process

The user tries to access an application (Service Provider) for the first time. The Service Provider redirects the user to the SSO identity provider (IdP) for authentication. The user enters a username and password, and the IdP verifies the credentials.

What problems does SSO solve? ›

Some of the biggest problems SSO solves are that it:
  • Makes your systems more secure, and decreases attack surface.
  • Saves your IT team time and money from automation, integration, and password resets.
  • Improves end-user experience, for both employees and customers.
  • Increases productivity, even when working remotely.
Apr 28, 2022

Does single sign-on require multifactor authentication? ›

MFA requires users to provide multiple forms of authentication, while SSO only requires a single set of credentials.

Is single sign-on the same as two factor authentication? ›

SSO makes logging easy but 2FA and MFA add security steps. Groups must carefully think about the good and bad of each sign-in method. They must make a plan to keep data safe that fits what they want and what the rules say.

What are two examples of common single sign-on authentication configurations? ›

Kerberos and smart card setups are common single sign-on configurations.

How does single sign-on SSO work? ›

Single sign-on (SSO) is a technology which combines several different application login screens into one. With SSO, a user only has to enter their login credentials (username, password, etc.) one time on a single page to access all of their SaaS applications.

What is the advantage of single sign-on? ›

SSO enhances user experience by providing seamless access to multiple applications with a single set of credentials. This improves user satisfaction and loyalty, leading to increased engagement and retention rates.

What is the difference between SSO and OAuth? ›

SSO (Single Sign-On) is an authentication method that allows users to authenticate once with an Identity Provider (IdP) and gain access to multiple apps. With OAuth you don't give the user access, rather the user gives you permission to access another app on their behalf.

What happens if single sign-on is enabled? ›

If single sign-on is enabled, it is strongly recommended that SSL communication be configured for the repository. Desktop client applications, such as Deployment Manager, create a Java subject and then establishes a GSS session with the repository using the subject context.

What are the advantages and disadvantages of single sign-on? ›

Disadvantages of Single Sign On (SSO):
SSO AdvantagesSingle Sign On Disadvantages
Reduces the load of memorising several passwords.When SSO fails, access to all related systems is lost.
Easy to implement and connect to new data sources.Increased risk of identity spoofing and phishing in user-external accesses.
1 more row

What is the benefit of using single sign-on SSO printing is? ›

HP PrinterOn Enterprise - What is SSO (Single Sign On)?

SSO advantages include: Eliminates credential re-authentication and help desk requests; thus, improving productivity. Streamlines local and remote application and desktop workflow. Minimizes phishing.

References

Top Articles
Latest Posts
Article information

Author: Allyn Kozey

Last Updated:

Views: 6205

Rating: 4.2 / 5 (43 voted)

Reviews: 90% of readers found this page helpful

Author information

Name: Allyn Kozey

Birthday: 1993-12-21

Address: Suite 454 40343 Larson Union, Port Melia, TX 16164

Phone: +2456904400762

Job: Investor Administrator

Hobby: Sketching, Puzzles, Pet, Mountaineering, Skydiving, Dowsing, Sports

Introduction: My name is Allyn Kozey, I am a outstanding, colorful, adventurous, encouraging, zealous, tender, helpful person who loves writing and wants to share my knowledge and understanding with you.