What is Single Sign-On (SSO) and How Does It Work? (2024)

What is Single Sign-On (SSO) and How Does It Work? (1)

By

  • Taina Teravainen

What is single sign-on (SSO)?

Single sign-on (SSO) is a session and user authentication service that permits a user to use one set of login credentials -- for example, a username and password -- to access multiple applications. SSO is used by organizations of all sizes and individuals to ease the management of multiple credentials.

What is Single Sign-On (SSO) and How Does It Work? (2)

How does single sign-on work?

Single sign-on is a federated identity management arrangement. The use of such a system is sometimes called identity federation. Open Authorization (OAuth) is the framework that enables an end user's account information to be used by third-party services, such as Facebook, without exposing the user's password.

OAuth acts as an intermediary on behalf of the end user by providing the service with an access token that authorizes specific account information to be shared. When a user attempts to access an application from the service provider, the service provider sends a request to the identity provider for authentication. The service provider then verifies the authentication and logs the user in.

In a basic web SSO service, an agent module on the application server retrieves the specific authentication credentials for an individual user from a dedicated SSO policy server, while authenticating the user against a user repository, such as a Lightweight Directory Access Protocol directory. The service authenticates the end user for all the applications the user has been given rights to and eliminates future password prompts for individual applications during the same session.

Types of SSO configurations

Some SSO services use protocols, such as Kerberos or Security Assertion Markup Language (SAML):

  • In a Kerberos-based setup, once user credentials are provided, a ticket-granting ticket (TGT) is issued. The TGT fetches service tickets for other applications the user wants to access, without asking the user to reenter credentials.
  • SAML is an Extensible Markup Language standard that facilitates the exchange of user authentication and authorization data across secure domains. SAML-based SSO services involve communications among the user, an identity provider that maintains a user directory and a service provider.
  • Smart card-based SSO asks an end user to use a card holding the sign-in credentials for the first login. Once the card is used, the user does not have to reenter usernames or passwords. SSO smart cards store either certificates or passwords.

Social SSO

Google, LinkedIn, Apple, Twitter and Facebook offer popular SSO services that enable end users to log in to third-party applications with their social media authentication credentials.

Many security professionals recommend end users refrain from using social SSO services because, once attackers gain control of a user's SSO credentials, they can access all other applications that use the same credentials.

Enterprise SSO

Enterprise single sign-on (eSSO) software and services are password managers with client and server components that log a user on to target applications by replaying user credentials. These credentials are almost always a username and password. Target applications do not need to be modified to work with the eSSO system.

SSO security risks

Although single sign-on is a convenience to users, it presents risks to enterprise security. An attacker who gains control over a user's SSO credentials is granted access to every application the user has rights to, increasing the amount of potential damage.

To avoid malicious access, SSO should be coupled with identity governance. Organizations can also use two-factor authentication (2FA) or multifactor authentication with SSO to improve security.

SSO advantages and disadvantages

Advantages of SSO include the following:

  • Users need to remember and manage fewer passwords and usernames for each application.
  • The process of authenticating with applications is streamlined -- no need to reenter passwords.
  • Successful phishing attacks are reduced.
  • IT help desks see fewer complaints or tickets regarding passwords.

Disadvantages of SSO include the following:

  • It does not address certain levels of security each application sign-on might need.
  • If availability is lost to apps that only allow SSO, users become locked out.
  • If unauthorized users gain access, they could access more than one application.

SSO vendors

Multiple vendors offer SSO products, services and features. SSO vendors include the following:

  • Rippling enables users to sign in to cloud applications from multiple devices.
  • Avatier Identity Anywhere is SSO for Docker container-based platforms.
  • OneLogin by One Identity is a cloud-based identity and access management platform that supports SSO.
  • Okta is an enterprise tool with SSO functionality.

Editor's note: This article was written by Taina Teravainen in 2020. TechTarget editors revised it in 2024 to improve the reader experience.

This was last updated in April 2024

Continue Reading About single sign-on (SSO)

  • Cloud IAM challenges and how to address them
  • Multi-cloud identity management tips and best practices
  • Use these user authentication types to secure networks
  • Top cloud IAM best practices to implement

Related Terms

digital signature
A digital signature is a mathematical technique used to validate the authenticity and integrity of a digital document, message or...Seecompletedefinition
OpenID (OpenID Connect)
OpenID Connect is an open specification for authentication and single sign-on (SSO).Seecompletedefinition
What is SSH (Secure Shell) and How Does It Work?
SSH (Secure Shell or Secure Socket Shell) is a network protocol that gives users -- particularly systems administrators -- a ...Seecompletedefinition

Dig Deeper on Identity and access management

  • Use these 6 user authentication types to secure networksBy: KyleJohnson
  • OpenID (OpenID Connect)By: RahulAwati
  • identity providerBy: BenLutkevich
  • logon (or login)By: RobertSheldon
What is Single Sign-On (SSO) and How Does It Work? (2024)

FAQs

What is Single Sign-On (SSO) and How Does It Work? ›

Single sign-on (SSO) is a technology which combines several different application login screens into one. With SSO, a user only has to enter their login credentials (username, password, etc.) one time on a single page to access all of their SaaS applications.

What is single sign-on SSO and how does it work? ›

Single sign-on (SSO) is an identification method that enables users to log in to multiple applications and websites with one set of credentials. SSO streamlines the authentication process for users.

What is single sign-on SSO simplified understanding how SSO works in plain English? ›

A single sign-on solution can simplify username and password management for both users and administrators. Users no longer have to keep track of different sets of credentials and can simply remember a single more complex password. SSO often enables users to just get access to their applications much faster.

What's the difference between single sign-on SSO and social sign-on answer? ›

The main difference between SSO (Single Sign-On) and social login is that SSO allows users to log in to multiple applications with a single set of credentials. In contrast, social login allows users to log in to one application using their social media account credentials.

What are three benefits of single sign-on? ›

SSO solves key problems for the business by providing:
  • Greater security and compliance.
  • Improved usability and employee satisfaction.
  • Lower IT costs.

What is a major risk of using single sign-on SSO? ›

Little Control once Access is Granted

If a user successfully logs in via SSO and falls prey to a phishing attack, there is not always a simple solution. The attacker gets access to all the endpoints of the external applications within the cloud that the user is provisioned for.

What is a single sign-on SSO approach that relies? ›

SSO is based on the federal identity system which relies on trust between a service provider (SP) and an identity provider (IdP). A certificate is exchanged between the IdP and the app which is used to signal identity information being sent between the two.

What is single sign-on SSO environments? ›

SSO is an authentication process in which a user can access more than one system or application by entering a single user ID and password. If you are an administrator, you need to specify the company that you want to access during login. Any other user is taken to their specific company.

What is the difference between single sign-on and single identity? ›

While you may often encounter SSO and FIM mentioned together, it's important to note they aren't interchangeable terms. Single sign-on grants access to applications and resources within a single domain, whereas federated identity management enables single sign-on across multiple domains or organizations.

What is the difference between single sign-on and non single sign-on? ›

SSO simplifies user access by allowing one set of credentials to unlock multiple applications, enhancing convenience and efficiency. In contrast, MFA strengthens security by requiring users to provide multiple verification factors before granting access, significantly reducing the risk of unauthorized entry.

Is Google sign-on SSO? ›

You can configure your Cloud Identity or Google Workspace account to use single sign-on (SSO). When you enable SSO, users aren't prompted to enter a password when they try to access Google services. Instead, they are redirected to an external identity provider (IdP) to authenticate.

Which of the following is a disadvantage of single sign-on SSO? ›

While this streamlines the login process and enhances user experience, it also poses security risks. A significant disadvantage of SSO is that if a user's password is compromised, it grants unauthorized access to all the applications and resources linked to that account.

What is SSO and how does it work? ›

Single sign-on (SSO) is a technology which combines several different application login screens into one. With SSO, a user only has to enter their login credentials (username, password, etc.) one time on a single page to access all of their SaaS applications.

What is the difference between single sign-on and true single sign-on? ›

Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems. True single sign-on allows the user to log in once and access services without re-entering authentication factors.

What happens if single sign-on is enabled? ›

If single sign-on is enabled, it is strongly recommended that SSL communication be configured for the repository. Desktop client applications, such as Deployment Manager, create a Java subject and then establishes a GSS session with the repository using the subject context.

What is the benefit of using single sign-on SSO printing is? ›

HP PrinterOn Enterprise - What is SSO (Single Sign On)?

SSO advantages include: Eliminates credential re-authentication and help desk requests; thus, improving productivity. Streamlines local and remote application and desktop workflow. Minimizes phishing.

What is the difference between same sign-on and single sign-on? ›

Single sign-on systems require a one-time authentication from the user. Once logged in, the user can access other web applications and services without re-authenticating themselves. Meanwhile, same sign-on requires the user to repeat the login process each time with the same authentication credentials.

References

Top Articles
Latest Posts
Article information

Author: Clemencia Bogisich Ret

Last Updated:

Views: 6199

Rating: 5 / 5 (80 voted)

Reviews: 87% of readers found this page helpful

Author information

Name: Clemencia Bogisich Ret

Birthday: 2001-07-17

Address: Suite 794 53887 Geri Spring, West Cristentown, KY 54855

Phone: +5934435460663

Job: Central Hospitality Director

Hobby: Yoga, Electronics, Rafting, Lockpicking, Inline skating, Puzzles, scrapbook

Introduction: My name is Clemencia Bogisich Ret, I am a super, outstanding, graceful, friendly, vast, comfortable, agreeable person who loves writing and wants to share my knowledge and understanding with you.