SSOGEN / SSO Explained: The Standards Behind Single Sign-On, MFA and AI Agent Identity
Learn
SSO Explained: The Standards Behind Single Sign-On, MFA and AI Agent Identity
Single sign-on lets one trusted identity provider vouch for you, and SAML, OpenID Connect, SCIM and MFA are the standards that carry that trust.
Updated
This guide is SSO explained from the protocols to the controls. Single sign-on (SSO) means a user authenticates once, to one trusted system, and then opens many applications without signing in to each. That system is the identity provider, and the applications trust what it tells them.
Everything else is detail: how that trust travels, stays current and gets stronger. Product steps are in the documentation, and each topic below links to them.
| Topic | One-line answer | In SSOGEN |
|---|---|---|
| SSO | Sign in once, open many applications | What SSOGEN is and single sign-on software |
| SAML | XML sign-in statements for enterprise and SaaS apps | Register a SAML application |
| OpenID Connect | Sign-in on top of OAuth 2.0, with a signed ID token | Register an OpenID Connect application |
| SCIM | A standard for creating and switching off accounts | Inbound provisioning |
| MFA | A second proof that it is the right person | Multi-factor authentication |
| AI agent identity | Knowing which agent called, for whom, and stopping it | AI agent identity |
How SSO works in three steps
- The application redirects the user to the identity provider.
- The provider authenticates the user, applies its policies and second factors, and returns a signed statement of who the user is.
- The application verifies the signature and starts a session.
The user enters the password once, at the provider. The application never sees it.
SAML: signed assertions for enterprise and SaaS applications
SAML 2.0 carries the signed statement as an assertion.
- Identity provider. It authenticates the user.
- Service provider. The application identifies itself by an entity ID and a reply address.
- Common failure. Most SAML failures are a mismatch in one of those two values, which is why SSOGEN matches them exactly.
Use SAML when an application’s settings page asks for identity provider metadata, an entity ID or a sign-in URL. The SAML guide lists every field.
OIDC: sign-in built on OAuth 2.0
- OAuth 2.0. It grants one program limited access to another.
- OpenID Connect. It adds a signed ID token that identifies the user, which makes OAuth usable for sign-in.
- In SSOGEN. Every application uses the authorization code flow with PKCE, not the implicit or hybrid flow.
Use OpenID Connect when an application asks for a client ID, a client secret or an issuer URL. If it supports both protocols, either works. Choosing how to connect an application lists the questions to ask, in order.
SCIM: keeping accounts in step
Sign-in is half of the job. When an employee leaves, the accounts in every application must be removed as well.
- Standard. SCIM 2.0 is the standard HTTP interface for that.
- Inbound. An HR system can push users into SSOGEN.
- Outbound. SSOGEN then creates, updates and deactivates accounts in applications that support SCIM.
- Records. The SSOGEN Directory shows how SSOGEN stores user records.
MFA types and what each one is worth
| Method | What the person does | Strength note |
|---|---|---|
| Authenticator app (TOTP) | Types a six-digit code that changes every 30 seconds | The default and the strongest of the code methods |
| Passkey | Approves with the fingerprint, face or PIN of the device in their hand | Cannot be phished, nothing is typed |
| Recovery code | Types one of a set of single-use codes | For a lost phone |
| Text message | Types a code sent by SMS | Weaker, can be intercepted |
| Types a code sent to their address | Weakest, use only as a fallback |
- NIST position. NIST SP 800-63B does not accept email as a second factor and restricts SMS.
- SSOGEN default. SSOGEN keeps both disabled unless a policy lists them.
- Phone app. The SSOGEN Authenticator is a phone app for iPhone and Android that approves sign-ins by number and shows TOTP codes.
- Other methods. MFA software covers the other methods.
AI agent identity: the same questions for software
An AI agent that calls your systems raises the questions SSO answered for users: which agent is calling, on whose behalf, with what permissions, and how to stop it. Long-lived keys answer none of them.
The controls that close that gap:
- Each agent has its own identity, with named owners.
- Credentials expire within minutes.
- A user consents before the agent acts on their behalf.
- Sensitive scopes require approval.
- Every decision is recorded.
Two standards apply: OAuth 2.0 token exchange (RFC 8693), for acting on behalf of a user, and DPoP (RFC 9449), which binds a token to the agent’s key. AI agent identity shows how SSOGEN does it.
Explainers by topic
Single sign-on basics
- What Is SSO? Single Sign-On Explained
- How Does SSO Work? The Sign-In Flow Step by Step
- SSO Benefits and Risks, With the Mitigations
- SSO vs MFA: Not Alternatives, Two Layers
- Federated Identity vs SSO: What Is the Difference?
- What Is an Identity Provider? One IdP, Many Service Providers
- IdP vs SP: The Two Roles in Every Sign-In
- SP-Initiated vs IdP-Initiated SSO
- SAML Single Logout (SLO) and OpenID Connect Logout
- SAML ACS URL, Entity ID and Audience
- Identity Broker: One Trust Point for Several Identity Providers
- SSO Gateway: Service Provider and Identity Provider Gateways
- Policy Enforcement Point and Policy Decision Point
- Web Access Management: What It Is and What Replaces It
- What Is SiteMinder? Components, Versions and Your Options
- Open Source SSO: The Options and When Teams Outgrow Them
- Authentication vs Authorization: Test Yourself, Then Trace One Request
Standards: SAML, OpenID Connect and OAuth 2.0
- What Is SAML? SAML 2.0 Explained
- SAML Authentication: How the Sign-In Works and Why It Fails
- SAML Assertion: An Annotated Sample, Line by Line
- What Is OpenID Connect? The ID Token, Scopes and Flows
- What Is OAuth 2.0? Roles, Grant Types and Why It Is Not Sign-In
- OIDC vs OAuth: What Is the Difference and Which Do You Use?
- What Is PKCE? The OAuth PKCE Flow, Verifier and Challenge Explained
Provisioning and MFA
- SCIM Provisioning Explained: How SCIM 2.0 Creates, Updates and Removes Accounts
- SCIM vs SAML: Provisioning Is Not Sign-In
- MFA Types: The Factor Categories and the Methods You Can Deploy
- Step-Up Authentication: Ask for a Stronger Factor Only When It Is Needed
- Why Is MFA Important? What It Stops, What It Does Not, and How to Roll It Out
- What Is an Authenticator App? See the Code Being Calculated
- App Passwords Explained: What They Are, When You Need One, and the Risks
- What Is a Passkey? Check Your Own Device
- Passkey vs Password: Seven Attacks on One Workday
- Passwordless Authentication: What It Is, Which Methods Count, and How It Works With SSO
- Are Passkeys Safe? What They Stop, and How They Can Still Fail
- Passkeys for Enterprise: Why Organizations Wait, and What Makes a Rollout Work
- Biometric Authentication: How It Works, Its Types, Its Limits, and Whether Face ID Is a Passkey
- What Is a Security Key? How FIDO2 Hardware Keys Work, and What Happens If You Lose One
- NIST Password Guidelines: What SP 800-63B-4 Requires
- Password Policy: What Each Setting Does and What to Set
- Credential Stuffing: How It Works, How It Differs From Password Spraying, and What Stops It
- Phishing Resistant MFA: What Qualifies, What Does Not, and How to Roll It Out
- MFA Fatigue Attacks: How Push Bombing Works and How to Stop It
Directories and access control
- What Is Kerberos? Tickets, Realms and How to Read klist Output
- LDAP vs Active Directory: What Each One Is and How They Fit Together
- LDAPS Port 636 and the Other LDAP Ports, Explained
- Active Directory Federation Services: What AD FS Does and When to Replace It
- RBAC vs ABAC: How They Differ and When to Use Each
Oracle and ERP sign-in
- OAM 12c End of Support: The Dates and Your Options
- Replace Oracle Access Manager for EBS: A Cut-Over Plan You Can Roll Back
- EBS Archive Instance Access: Your Old Oracle EBS After the Move to Fusion
- RPA Service Accounts in Oracle EBS: Why Bots With Human Passwords Are an Audit Finding
Attacks and risks
- MFA Bypass: How Attackers Get Past MFA, and What Stops Each Method
- Evilginx and Adversary-in-the-Middle Phishing: How It Works and What Stops It
- SIM Swapping: How It Works, How to Tell, and What to Do in the First Hour
- Session Hijacking: How Stolen Sessions Work, Why MFA Does Not Help, and What Stops Them
- Is SSO Secure? What It Improves, What It Concentrates, and the Controls That Matter
- Password Manager vs SSO: What Each One Does and When to Use Which
- The Future of Authentication: What the Standards Say, What Is Slow, and Who Else Signs In
Free tools you can use in the browser (all of them, with a full list on the tools page)
- SAML Tracer: Decode a SAML Response in Your Browser
- Jump Box: SSO, MFA, SSH and RDP, and What Replaces It
- JWT Decoder: Inspect and Verify a Token in Your Browser
- SAML Metadata Checker: Read and Validate IdP and SP Metadata
- SAML Metadata Generator: Build Service Provider or Identity Provider Metadata
- JWKS: Inspect, Convert and Match a JSON Web Key Set
- TOTP Generator: Make a One-Time Code From a Secret
- Event ID 4625: Decode a Failed Windows Logon, Free in Your Browser
- Free CSR Generator: Create a CSR and Private Key in Your Browser
- CSR and Certificate Decoder: Read Names, Chain and Dates
- DPoP Proof Checker: Verify the Key Binding
- AI Agent Permission Builder: Draft Least-Privilege Scopes
AI agents and machine identity
- Agentic AI Security: Risks and Controls for AI Agents
- AI Agent Governance: A Practical Checklist
- Non-Human Identity: Service Accounts, Keys, Workloads and Agents
- AI Agent Delegation Audit: Who Approved That Action?
- AI Agent Access to Oracle EBS Without a Password
- Offboarding AI Agents When an Employee Leaves
- What Is an MCP Server, and Who Is Signed In When It Runs?
- MCP vs API: What Changes for Sign-In and Permissions
- OWASP Top 10 for LLM Applications, Mapped to Identity Controls
- The Confused Deputy Problem, From Compilers to AI Agents
- SPIFFE and SPIRE Explained
- Oracle MCP Servers and Safe Agent Access to Oracle Data
- MCP Authentication: What the Specification Requires
- DPoP OAuth: How Proof-of-Possession Tokens Work
- OAuth Token Exchange: Delegation and Impersonation Under RFC 8693
- Entra Agent ID: What Microsoft Documents, Object by Object
- Claude Code SSO and Identity for AI Coding Assistants
Questions people ask
Is SSO the same as MFA?
No. SSO reduces how often users sign in, and MFA strengthens each sign-in. They work together, and a policy can require a second factor only for sensitive applications.
Do I need SAML and OpenID Connect both?
Usually not. Use whichever protocol each application supports. SSOGEN supports both, so a mix is fine.
Is a passkey MFA?
A passkey is a phishing-resistant sign-in on its own. A policy can require “a passkey or security key” for sensitive applications.
Where to go next
- Connections. The integrations map shows which systems connect to which.
- Product. Start with single sign-on software.
- Comparison. Compare products in the SSO comparison.
- Documentation. Open the documentation for exact screens and fields.