SSOGEN / What is SSO (single sign-on)?
Learn
What is SSO (single sign-on)?
Single sign-on lets a person sign in once at an identity provider; every application then trusts its signed answer instead of asking again.
Updated
Why organizations do it
- Fewer passwords. People stop reusing and forgetting them. Weak passwords inside applications stop being a risk because the application no longer holds them.
- A second step in one place. A password alone is not enough. With SSO, multi-factor authentication is set up once and covers every application behind it.
- Fewer help-desk calls. Password resets and lockouts drop.
- One portal for every application. People open applications from a portal and no longer keep a list of addresses.
- Access ends in one step. When someone leaves, removing their account ends access to every application.
- One password policy. Length, change and lockout rules are enforced where the password is checked.
- A trail for auditors. Who signed in to what, and when, is recorded centrally.
How it works
An application that uses SSO does not check passwords. It sends the person to the sign-in service, which checks them against the directory that holds the accounts, for example Active Directory, and then sends them back with proof of who they are. The sign-in service keeps a session in the browser.
- The person opens Application 1.
- Application 1 sends them to the sign-in service.
- They enter their username and password, and a second step if the policy asks for one.
- The service checks the password against the directory and starts a session in the browser.
- The person is sent back to Application 1 and carries on.
- Later they open Application 2.
- Application 2 also sends them to the sign-in service. The session is still valid, so nobody is asked for a password.
- They arrive in Application 2 signed in.
No application ever sees the password. The proof that comes back is a signed message, usually SAML or OpenID Connect; see SAML or OpenID Connect.
The pieces
- Applications register with the sign-in service and trust its signed answer.
- The sign-in service (the identity provider) runs the sign-in, the second step and the session.
- The directory holds the people, their passwords and their groups.
- The portal is a page where a person opens every application they may use, so they need not remember addresses.
Applications that cannot do SSO themselves
Most older systems were built before the standard protocols. A module in the web server, a Java agent or a gateway can put the sign-in in front of them without changing them. See single sign-on for legacy applications.
What to ask before you choose a product
- Cost. What does the product charge for the parts needed to make it work?
- Where the passwords go. Does it copy passwords to a cloud service, or check them against your directory?
- Complexity. How many servers and specialists does it take to run, and what happens to your applications if it is down?
- Reach. Does it cover your oldest applications as well as the new ones?
SSOGEN runs hosted or on your own servers, checks passwords against your directory, and covers old and new applications. See single sign-on and why SSOGEN.
Questions
Is single sign-on safe?
It is safer than a password per application, as long as the sign-in itself is strong. That is why SSO is paired with a second step, such as approving the sign-in on a phone.
Is SSO the same as a password manager?
No. A password manager fills in passwords for you. With SSO, an application receives a signed answer from the identity provider, never the person’s password.
What is the difference between SSO and SAML?
SSO is the goal. SAML and OpenID Connect are the standard ways an application and a sign-in service talk to each other to reach it.