Single Sign-On (SSO): Meaning, How It Works and Security

What Is Single Sign-On?

SSO stands for single sign-on. You sign in once in the morning and can then use email, chat, file storage, CRM and many other applications. No further password is needed.

The idea is like a company badge. At reception, your identity is checked once. After that, the badge opens every door you are allowed through. No one needs to see your ID card at each door.

In companies, SSO is now standard. It saves time, takes load off the IT help desk and makes signing in more secure.

How an SSO Login Works

Three parties work together in SSO: the user, the application (service provider) and the central sign-in service (identity provider, IdP). A typical flow:

1. Open the app: you open an application, such as file storage.
2. Redirect: the application does not know you yet and sends you to the identity provider.
3. Sign in: you sign in there, for example with a password and a passkey as the second factor.
4. Confirmation: the identity provider issues a digitally signed confirmation, a token or assertion. It states who you are and which roles you have.
5. Access: the application checks the signature and lets you in.
6. Next app: if you then open the chat, the identity provider recognizes your active session. You are signed in at once.

Note: the applications never see your password. They only trust the identity provider's confirmation.

The Key Standards

• SAML 2.0: the classic standard for business applications in the browser. It uses XML messages.
• OpenID Connect (OIDC): builds on OAuth 2.0 and uses compact JSON tokens. It suits web apps, mobile apps and APIs.
• OAuth 2.0: controls the granting of access, for example when an app may access your calendar. OAuth alone is not meant for signing in. OIDC exists for that.
• Kerberos: the SSO method in Windows networks with Active Directory. Whoever signs in to their computer gets a ticket for other services on the network.

In addition, SCIM makes sure user accounts are created, changed and blocked automatically in all connected applications.

How It Differs from Similar Methods

• Password manager: stores many passwords. Each application still checks its own.
• Password sync: the same password applies in several systems. But each application asks for it again.
• Federation: SSO across company borders. Partners sign in at their own identity provider and get access to your applications.
• Social login: signing in with an existing account at a large provider. Common in private use, rare in companies.

Benefits of SSO

• Fewer passwords: staff remember one strong password instead of many weak ones.
• MFA for everyone: a second factor can be enforced centrally for all applications. See multi-factor authentication.
• Faster access: fewer sign-ins save time every day.
• Less support: requests to reset passwords drop sharply.
• Clean exits: when someone leaves the company, IT blocks one account instead of twenty.
• Overview: all sign-ins run through one place and are logged there.

Risks and Challenges

• One key for everything: if the SSO account is taken over, all applications are open. Without a strong second factor, this is dangerous.
• Outage: if the identity provider fails, no one can sign in. It must be highly available.
• Phishing: fake sign-in pages target SSO accounts on purpose. Phishing-resistant factors such as passkeys help.
• Stolen sessions: attackers try to steal session cookies or tokens. Short lifetimes and binding them to the device make this harder.
• Old applications: not every piece of software supports SAML or OIDC.

Rolling Out SSO Securely

1. List the applications: which systems are there, and which standards do they support?
2. Choose an identity provider: it should support SAML 2.0, OIDC and SCIM and connect to your directory, such as Active Directory.
3. Enforce strong MFA: ideally with passkeys or FIDO2 keys, which protect against phishing.
4. Set access rules: conditional access checks each sign-in, for example group, application or origin. See identity and access management.
5. Connect step by step: first a few applications, then the rest.
6. Monitor: analyze sign-ins and report unusual patterns.

Single Sign-On with SecTepe.Comm

SecTepe.Comm has one central sign-in for all services. It follows the open standards OIDC and SAML 2.0 and uses the proven open-source sign-in server Keycloak. You confirm the second factor with one-time codes from an app (TOTP), FIDO2 hardware keys or passkeys. Accounts are created automatically via SCIM, and an existing Active Directory can be connected. Conditional access rules decide on each sign-in, and new passwords are checked against a public database of leaked passwords.

Conclusion

Single sign-on means: sign in once, use many applications. This is more convenient and usually more secure than many separate passwords. What counts is a strong second factor, a highly available identity provider and open standards such as SAML and OpenID Connect.