What it means
Single sign-on lets a user authenticate through a shared identity service and access multiple participating applications without independently signing in to each one every time. Applications typically rely on assertions or tokens that convey authentication information. Each application still decides the user's permissions and commonly maintains its own session.
Centralization can improve consistent authentication and account administration, while making the identity service an important dependency. The design must account for outages, compromised sessions, recovery, and applications that retain local sign-in paths. Single sign-on and federation are related concepts: federation describes trust and identity information exchanged between parties, while SSO describes the user's sign-in experience.
AN ILLUSTRATIVE SCENARIO
A university staff portal
A university connects its learning platform and expense system to a shared identity provider. A staff member signs in once, then opens both applications. The expense system still limits approvals to the staff member's assigned department. When an account is disabled after a departure, the administrator checks both applications rather than assuming every existing session ends immediately. The university also exercises a controlled recovery process for an identity-provider outage without leaving everyday bypass accounts unmanaged.
Put it to work
- Inventory participating applications, their trust configuration, local login alternatives, and who owns the identity provider and application sessions.
- Use maintained protocol implementations; validate the issuer (trusted identity provider), audience (intended application), signature, and time limits of received authentication information.
- Test sign-in, account disablement, session termination, and provider unavailability; document where application-specific action or emergency access is required.
How to check your work
Demonstrate the intended experience across two test applications, then disable the test identity and examine both new sign-ins and existing sessions. Record any delay or separate revocation step.
Connect the ideas
- Federation
Trusting authentication assertions from an external identity provider instead of storing every password locally.
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- Session
State linking multiple requests; an authenticated session associates later requests with a previously authenticated identity until it expires or is revoked.