Cybersecurity glossary
What is Single Sign-On (SSO)?
Learn what Single Sign-On (SSO) is, how SAML and OIDC enable one login across apps, security benefits and risks of centralized identity, and SSO hardening best practices.
Definition
Single Sign-On (SSO) is an authentication architecture that lets users access multiple applications with one set of credentials and a shared login session, typically mediated by a central identity provider using protocols such as SAML or OpenID Connect.
Why organizations adopt SSO
Employees and partners use dozens of SaaS tools. Separate passwords create friction and shadow IT. Single Sign-On (SSO) centralizes authentication so security policy is applied once—and users get a smoother experience.
Done well, SSO improves security. Done poorly, it concentrates risk.
How SSO typically works
User opens an application
The service provider (SP) or relying party detects no local session.
Redirect to identity provider
The user is sent to the IdP for authentication (password, MFA, passkeys).
IdP issues an assertion or tokens
SAML assertions or OIDC ID/access tokens prove the user’s identity.
Application establishes a session
The SP validates the response and creates a local application session.
Subsequent apps reuse IdP session
While the IdP session is valid, other SSO apps can skip password prompts.
Benefits and concentrated risks
| Aspect | Upside | Downside if weak |
|---|---|---|
| Credentials | Fewer passwords to phish or reuse | IdP credentials unlock many apps |
| MFA | Enforce once centrally | Apps trusting IdP without MFA inherit weakness |
| Offboarding | Disable one account everywhere | Broken deprovisioning leaves orphan access |
| Visibility | Central auth logs | Blind spots if apps skip federation events |
Protocol landscape
SAML 2.0
XML assertions widely used in enterprise workforce SSO.
OpenID Connect
JSON/JWT identity layer popular for modern web and mobile apps.
WS-Fed / others
Legacy federation protocols still present in some estates.
Social login
Consumer SSO via major IdPs using OAuth/OIDC flows.
- Enforce phishing-resistant MFA at the identity provider.
- Validate signatures, audiences, issuers, and clocks on every assertion/token.
- Use short IdP and application session lifetimes with re-auth for sensitive apps.
- Automate joiner-mover-leaver provisioning and immediate session revocation.
- Prefer official IdP libraries; avoid custom federation parsers.
- Monitor impossible travel, MFA fatigue, and anomalous SSO app access.
- Segment break-glass admin accounts outside routine SSO where required.
- Document which apps trust which IdPs and review trust relationships regularly.
The practical takeaway
SSO lets one authenticated identity unlock many applications. It strengthens security when the IdP is hardened and apps validate federation correctly—and multiplies blast radius when they do not.
Centralize login, then treat the identity provider like production infrastructure: monitored, MFA-gated, and rapidly revocable.
Related security terms
Frequently asked questions
What is SSO in simple terms?
You log in once to a central identity provider and then open many apps without typing your password again for each one.
Is SSO the same as OAuth?
Not exactly. OAuth is primarily authorization. SSO is the user experience and architecture; it often uses SAML or OIDC (which builds on OAuth).
What are the security benefits of SSO?
Centralized MFA, faster offboarding, consistent password policy, and fewer passwords stored in individual apps.
What are the risks of SSO?
The identity provider becomes a high-value target. One compromised SSO session or IdP can unlock many applications.
Should every app use SSO?
For workforce and B2B apps, usually yes. Consumer apps may use social login variants of the same patterns with different risk tradeoffs.
How do you harden SSO?
Enforce MFA at the IdP, use short assertion/token lifetimes, validate signatures strictly, monitor federation events, and revoke sessions on offboarding.
References
Explore authoritative guidance and frameworks related to single sign-on (sso).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.