Single Sign-On (SSO)

Single Sign-On vs. Same Sign-On

Despite sharing the acronym “SSO,” single sign-on and same sign-on function differently. Both authentication methods store and synchronize a single set of login credentials for each user, but only single sign-on allows users to bypass subsequent login prompts.

Similar to Active Directory and Lightweight Directory Access Protocol (LDAP), same sign-on merely remembers and populates credentials for each login request.

In other words, single sign-on is like a fast-pass or pre-check status that expedites access across various systems after a single successful login. Same sign-on, conversely, is more like security checkpoints at different buildings on a corporate campus, each accepting the same verified information but still requiring individuals to provide it repeatedly.

How Does SSO Work?

Single sign-on procedures require precise, secure interactions between trusted third-party IdPs and websites or applications (i.e., “relying parties” or “service providers”) requiring user authentication.

The process begins with a user either logging into an IdP’s SSO application or trying to access a separate site that redirects the user to the IdP’s single sign-on portal, usually with a prompt like “Login with SSO.”

After the user enters their corresponding login credentials, the IdP confirms their identity and generates an identity token containing verified identity information about the user, such as their name or email address.

The token then acts like an SSO ID badge or pass that each site automatically accepts based on its trusted relationship with the IdP. In some cases, the IdP can also generate an access token defining what the user’s device is authorized to do (i.e., log into the app) or replace tokens altogether with secured SSO codes.

Types of Single Sign-On Solutions

Most SSO authentication processes are social or enterprise-based, meaning they rely on the authority of a popular social media site or service provider (e.g., Apple or Google), or businesses purchase them as software from SSO providers for their employees and clients to use.

Regardless, both types are considered a form of federated identity management (FIM), which is a framework for allowing two or more domains, systems, or networks to trust and communicate with each other.

Open Authorization 2.0 (OAuth 2.0), for example, is another type of FIM that focuses on granting third-party apps or services limited access to resources or networks without the need for passwords. Instead of asking, “Is this User A trying to access these websites?” as single sign-on does, OAuth 2.0 asks, “What can Application A do with User B’s data on Website C?”

Benefits of Single Sign-On	Single Sign-On Challenges
Improved User Experience: SSO solutions streamline user access by reducing login frequency and simplifying the authentication experience.	SSO Security: Allowing one set of credentials so much access risks greater damage if said credentials are ever compromised or stolen.
Password Manager: SSO reduces password exposure and vulnerability by minimizing the number of passwords a user must remember.	Access Dependency: Linking widespread access to SSO can create greater disruptions from an SSO database outage.
Centralized Control: Due to the centralized system feeding its network, SSO makes it easier to grant, change, or revoke user access across multiple systems.	Compatibility Issues: Not all applications may be compatible with a company’s chosen SSO platform or provider.
Increased IT Bandwidth: Employees who only need to remember one set of credentials are less likely to submit IT requests asking to retrieve or reset forgotten passwords.	Setup Challenges: Initial SSO implementation can be costly and complicated regardless of an organization’s size or industry.
SSO Basic Understanding: From an end user’s perspective, the simplicity of the SSO process makes it easy to comprehend and adopt.	Compliance: Older SSO setups may not comply with recent legislation regarding sharing user information or data privacy.