Single sign-on (SSO) is an authentication scheme that lets a person sign in once and then access multiple applications without signing in again. An identity provider authenticates the person and tells each application, through a trusted token, that they are who they claim to be.

How does SSO work?

1. The person tries to open an application.
2. The application redirects them to the identity provider.
3. The person authenticates there, ideally with MFA.
4. The identity provider issues a token or assertion.
5. The application grants access based on it.

Which protocols does SSO use?

• SAML: an established standard for sign-in to web applications.
• OpenID Connect: an identity layer built on OAuth 2.0, widely used by modern applications.
• OAuth 2.0: a framework for delegated authorisation, often used together with OpenID Connect.
• Kerberos: the ticket-based mechanism behind SSO inside Windows domains.

What are the benefits of SSO?

Fewer passwords for people to reuse or forget, a better user experience, central enforcement of MFA and conditional access, faster onboarding and offboarding and one place to audit sign-ins.

What are the risks of SSO?

• Concentration: one login opens many applications, so that identity is worth more to an attacker.
• Token theft: a stolen session token can be used without any password.
• Compromised identity provider accounts, especially administrators.
• Forged tokens if signing keys are stolen.
• Applications outside SSO that keep their own accounts.
• Weak account recovery.

What is a session token and why does it matter?

After sign-in, the application receives a token that proves the identity for a period. If an attacker steals it, they can act as the person without a password or MFA. Short lifetimes and monitoring of unusual use reduce the risk.

Is SSO secure?

It can improve security, because it centralises controls such as MFA and removes many weak passwords. It also raises the stakes for the one identity that unlocks everything, so that identity needs the strongest protection.

How is SSO different from federation?

SSO is about signing in once across applications. Federation extends that trust across organisations, so that people from one organisation can access another’s applications with their own identity.

What does an SSO incident look like?

An attacker steals a session token from a phished employee. They use it to open the email, the document store and the finance application, all without a password prompt. Each access is valid, and the identity provider sees nothing unusual at sign-in.

What is an identity provider?

The service that authenticates people and issues the tokens that applications trust. It holds the most sensitive set of sign-in decisions in the organisation, which is why its administrators and its configuration need the strongest protection.

How is SSO different from a password manager?

A password manager stores and fills different passwords for different applications. SSO removes the need for separate sign-ins by trusting one identity provider. SSO also lets the organisation apply MFA and conditional access in one place.

What about applications that do not support SSO?

They keep their own local accounts, which sit outside central controls and are easy to forget. These accounts are common blind spots, and they are often where dormant and over-privileged access builds up.

What are best practices?

• Protect the identity provider with phishing-resistant MFA, especially for administrators.
• Apply conditional access to sensitive applications.
• Keep session lifetimes short for sensitive systems.
• Bring as many applications as possible under SSO.
• Review the permissions granted to applications.

Does SSO remove the need for monitoring?

No. It makes sign-in smoother and more controlled, but it does not show what an identity does in each application afterwards.

Sharelock monitors behaviour after login across applications, down to individual transactions and queries on critical applications, so a valid session that acts unlike its owner stands out.

‍