What Is Single Sign-on (SSO)? How It Works

Summary

Single Sign-On (SSO) simplifies user authentication by allowing access to multiple services with a single login. SSO is built on federated identity, enabling secure identity sharing across independent systems. Common protocols include SAML, used for enterprise environments, and OpenID Connect, often seen with services like Google and YouTube. The video walks through an SSO login flow, detailing how authentication works with these protocols, highlighting the advantages of seamless access across applications like Gmail and Workday. The decision between SAML and OpenID Connect depends on the application and integration needs.

Takeaways

• 😀 SSO (Single Sign-On) allows users to access multiple applications using a single login credential.
• 😀 SSO enhances convenience by enabling users to log into various apps without needing to repeatedly authenticate.
• 😀 The concept of federated identity underpins SSO, allowing identity information to be shared across different, independent systems.
• 😀 Two common protocols for SSO authentication are SAML (Security Assertion Markup Language) and OpenID Connect.
• 😀 SAML is an XML-based standard often used in work environments for exchanging identity information between services.
• 😀 OpenID Connect is a popular authentication protocol that uses JWT (JSON Web Token) to share identity information.
• 😀 A typical SSO login flow involves a Service Provider (e.g., Gmail), an Identity Provider (e.g., Okta), and a user’s browser.
• 😀 In a SAML-based flow, once authenticated, a SAML assertion is created and used to grant the user access to requested services.
• 😀 SSO reduces the need for multiple logins by reusing the credentials stored in the Identity Provider, streamlining access to various services.
• 😀 OpenID Connect is often used in consumer applications, like Google, YouTube, and others, where JWT is used instead of XML for identity data.
• 😀 The decision between using SAML or OpenID Connect for SSO depends on the specific application's needs and which protocol is easier to integrate.

Q & A

What is SSO (Single Sign-On)?

SSO is an authentication scheme that allows users to access multiple applications and services using a single ID. It simplifies the login process by enabling access to many apps without needing to log in each time.

How does SSO work in apps like Gmail, Workday, or Slack?

In apps like Gmail, Workday, or Slack, SSO provides a pop-up widget or login page where users enter the same set of credentials. This eliminates the need for repeated logins across different applications.

What is federated identity in the context of SSO?

Federated identity is the concept that enables sharing identity information across trusted, independent systems. This allows users to authenticate once and gain access to multiple systems that rely on this shared identity information.

What are the two common protocols used in SSO authentication?

The two common protocols used for SSO authentication are SAML (Security Assertion Markup Language) and OpenID Connect.

What is SAML, and where is it commonly used?

SAML is an XML-based open standard for exchanging identity information between services. It is commonly used in work environments for enterprise-level SSO implementations.

What is OpenID Connect, and how does it differ from SAML?

OpenID Connect is another SSO protocol that uses JSON Web Tokens (JWT) to share identity information between services. It is more commonly used for personal accounts, such as signing into applications with a Google account, whereas SAML is used more in enterprise environments.

Can you explain a typical SSO login flow using SAML?

In a typical SSO login flow using SAML, a user visits an application like Gmail. The Gmail server detects the user's work domain, sends a SAML authentication request, and redirects the user to the Identity Provider for login. Once authenticated, the Identity Provider generates a SAML assertion, which is validated by the service provider, granting the user access to the app.

How does SSO work when a user accesses multiple applications, like Workday, after logging in once?

After logging into one application, such as Gmail, using SSO, the user can seamlessly access other integrated apps, like Workday, without having to log in again. The Identity Provider generates a new SAML assertion for each subsequent app, which is validated by the service provider for access.

What is the role of the Identity Provider in the SSO process?

The Identity Provider is responsible for authenticating the user and generating the SAML assertion (or JWT in the case of OpenID Connect). It is a service that manages and verifies user identities across applications and services.

Which SSO method should be used, SAML or OpenID Connect?

Both SAML and OpenID Connect are secure protocols. The choice between the two depends on the application being integrated and which protocol is easier to implement. OpenID Connect is commonly used for web applications integrating with platforms like Google, Facebook, and GitHub, while SAML is often used in enterprise environments.