# What is Single Sign-On?

Also called SSO.

Single sign-on is an authentication arrangement in which a user authenticates once with a central identity provider and then reaches multiple independent applications without entering credentials again. The applications trust assertions issued by that provider instead of storing passwords themselves. It is a generic model implemented through open protocols rather than a single product.

The usual flow redirects an unauthenticated user from an application to the identity provider, which verifies the user and returns a signed assertion or token describing who they are and, often, which groups or attributes they hold. The application validates the signature and establishes a local session. Widely used protocols include SAML and OpenID Connect, the latter layered on OAuth.

The benefit is concentration of control. Password policy, multi factor requirements, device checks, and account deactivation are enforced in one place, so removing a departing user's access becomes a single action rather than an audit of every application. Central logs also make authentication events reviewable across the whole estate, which supports investigation after an incident.

The same concentration is the principal risk. Compromise of the identity provider, of a signing key, or of a highly privileged administrator account exposes everything that trusts it, and an outage can block access to all connected applications at once. Mitigations include strong authentication for administrators, key rotation, monitoring of assertion issuance, and defined emergency access procedures.

Single sign-on answers who the user is, not what they may do. Authorization remains the responsibility of each application, commonly implemented with roles derived from groups or claims carried in the token. Sessions also need explicit lifetime and revocation handling, since a token issued earlier can otherwise outlive the access decision that originally justified it.

## Key points

- Authenticate once with a central provider, reach many applications.
- Applications trust signed assertions instead of storing passwords.
- Commonly built on SAML or OpenID Connect.
- Centralizes policy, deactivation, and authentication logging.
- Concentrates risk, since provider compromise is systemic.

## In practice

An employee opens an internal analytics tool and is redirected to the company identity provider. Because they signed in that morning and passed a second factor, the provider issues a token stating their identity and group membership. The analytics tool validates it, creates a session, and grants the permissions mapped to that group. No password ever reached the analytics tool.

## Related terms

- [Role Based Access Control](/en/glossary/role-based-access-control)
- [OAuth](/en/glossary/oauth)
- [Zero Trust](/en/glossary/zero-trust)
- [Least Privilege](/en/glossary/least-privilege)
- [Audit Trail](/en/glossary/audit-trail)

[Back to the AI Glossary](/en/glossary)