SSO

IT supportsecuritycloud

Single Sign-On: authenticate once, reach many applications - identity centralized, passwords decimated, and one very important basket for the eggs.

SAML and OpenID Connect are its wire protocols; the IdP is its heart.

Single sign-on means authenticating once to an identity provider and then reaching many applications without authenticating again. The user-visible benefit is convenience; the security benefit is larger and less obvious, because it removes a password per application, centralizes multi-factor enforcement, and makes revocation a single action rather than a scavenger hunt.

The mechanics vary but the shape is constant. The application redirects to the identity provider, the provider authenticates and returns a signed assertion or token, and the application trusts it after validating the signature, the audience and the expiry. SAML and OIDC are the two dominant protocols, and Kerberos does the same job inside a Windows domain.

The concentration is the trade to state plainly. Centralizing authentication means the identity provider becomes both the single point of failure and the highest-value target: an outage locks everyone out of everything, and a compromised administrator account is not one application but all of them. That is why identity infrastructure deserves the strongest available protection, and why session lifetime, not just login, is where the remaining risk lives.

← All glossary entries