Single Sign-On (SSO)

With single sign-on, applications don’t manage passwords. They redirect users to a trusted identity provider (IdP), which authenticates the user and sends back a signed assertion or token.

Users get one login and one MFA prompt; companies get central control — disable one account and access to every app is gone.

Diagram

App B redirects to the same identity provider, which recognises the existing session — no second password.

How it works

The user opens App A, which has no session for them.
App A redirects the browser to the IdP with an authentication request.
The user signs in at the IdP (password, passkey, MFA). The IdP sets its own session cookie.
The IdP redirects back with a signed SAML assertion or OIDC code, which App A validates.
Later the user opens App B; it redirects to the IdP, which sees the existing session and returns immediately.

Key concepts

SAML 2.0: XML-based assertions; widespread in enterprise apps.
OpenID Connect: JSON/JWT-based, built on OAuth 2.0; the modern default for web and mobile.
Service provider (SP): The application that trusts the IdP.
Federation: Trust between organisations, so partners can sign in with their own company accounts.
Single logout: Ending the session at the IdP and, where supported, in every app.

Trade-offs

Benefits

One strong login with MFA for every app
Central onboarding and offboarding
Apps never see or store passwords

Costs

The IdP becomes critical — if it is down, nobody signs in
Integration and certificate management take effort
A compromised IdP account opens every app

Use it when

Companies with several internal or SaaS applications
B2B SaaS where customers want to use their own corporate identity

Common mistakes

Not validating the signature, audience and expiry of assertions
Open redirect bugs in the return URL
Forgetting to also disable local accounts when moving to SSO

Interview questions

Q1What is the difference between SSO and OAuth?

SSO is the user experience of signing in once. OAuth 2.0 is a delegated authorization framework; OpenID Connect on top of it is one common way to implement SSO.

Q2SAML or OIDC for a new SaaS product?

Support OIDC first because it is simpler and fits modern apps, and add SAML because many enterprise customers still require it.

Q3Why is MFA at the IdP so valuable?

One MFA policy protects every connected app, instead of each app implementing its own.