Single sign-on lets users log in once and access multiple applications without entering credentials again. The user authenticates to an identity provider. That provider issues a token or assertion. Each application trusts the provider and accepts the token. The user moves between systems seamlessly. IT manages one set of credentials instead of dozens.

SSO improves security and usability. Fewer passwords mean fewer reused passwords and fewer help desk tickets. It centralizes authentication, which makes it easier to enforce MFA and revoke access when someone leaves. It also concentrates risk. If the identity provider is compromised, every connected application is exposed. The 2020 SolarWinds attackers used SAML token forging to bypass SSO and access Microsoft 365 accounts. The technique exploited a weakness in how tokens were validated. SSO is not a silver bullet. It needs strong authentication at the provider, monitoring for anomalous token use, and careful configuration. Done well, it reduces attack surface and improves user experience. Done poorly, it creates a single point of failure that attackers will find.

SSO protocols

• SAML — XML-based, common in enterprise applications
• OAuth 2.0 — authorization framework, widely used
• OpenID Connect — authentication layer on top of OAuth
• Kerberos — ticket-based, common in Windows environments

SSO is convenient and risky in equal measure. The convenience is why it spread. The risk is why it needs careful hardening.