Single Sign-On
Also known as:
- Identity Provider (IdP)
- Enterprise Single Sign-On (SSO)
What problem does it target?
Users often need access to many applications. Without SSO, each application may maintain its own password and session.
This results in:
- Poor user experience (many passwords, frequent logins)
- Inconsistent or weak authentication policies
- Difficult offboarding (user accounts persist after termination)
- Increased attack surface (more password interfaces to misconfigure)
What does this solution do?
SSO centralizes authentication. Users authenticate once to an identity provider (IdP), which then federates identity to other systems.
SSO enables:
- Reduced credential sprawl
- Standardized and stronger authentication
- Centralized MFA enforcement
- Simplified provisioning and deprovisioning
- Improved auditability and visibility
Common Protocols:
- SAML 2.0 – for legacy and enterprise applications
- OIDC/OAuth2 – for modern applications and APIs
Who is this for?
- Organizations with many internal and SaaS/on-prem applications
- Security-conscious environments seeking centralized login control
- Companies enforcing MFA or passwordless login across systems
Who might not benefit from this?
- Very small organizations with only 1–2 systems
- Temporary or disposable environments (e.g., test labs)
- Applications that cannot federate (legacy, homegrown, air-gapped systems)
Pitfalls and remedies
| Pitfall | Remedy |
|---|---|
| Only some apps are connected to SSO | Maintain an application inventory and require all apps to integrate with the IdP. |
| SSO bypassed using local logins | Disable local accounts or restrict them using conditional access. |
| Misconfigured trust relationships | Test federation flows; enforce signed and validated assertions. |
| Weak MFA enforcement | Use Conditional Access Policies or equivalent to require strong MFA. |
| Difficult user experience | Combine SSO + Passwordless and deploy a unified SSO Portal for ease of access. |
Sample products
- Okta Workforce Identity
- Microsoft Entra ID (formerly Azure AD)
- Ping Identity
- Google Workspace (SSO features)
- Auth0 (also used for CIAM)
- ForgeRock Identity Platform