Single sign-on
Single sign-on is an authentication arrangement in which one authentication event enables a user to access multiple applications or services without signing in separately to each.
Software Security for Developers
A single sign-on service centralizes user authentication and enables authenticated users to access multiple applications without separately authenticating to each one.
- How it is used
- Centralizes authentication for customers, employees, partners, and multiple applications.
- How deep it goes
- Explains SSO architecture, deployment choices, federation, protocols, and tokens, while deferring detailed SAML and LDAP treatment.
- Examples
- Uses customer social login, employee corporate applications, partner access delegation, and unified login across multiple work applications.
- What you can do after
- Apply SSO by integrating applications with an IdP through OIDC, OAuth2, or WebAuthn.
Read how Software Security for Developers explains single sign-on →
Real-World Cryptography
Single sign-on is an authentication scheme that lets a user access multiple services by authenticating through one account provider.
- How it is used
- Reduces password reuse and mental load by federating authentication across multiple services.
- How deep it goes
- Defines SSO, names SAML and OIDC, and warns about OAuth2 misuse without detailing protocol message flows.
- Examples
- Uses Facebook or Google authentication to connect a user to Airbnb without another password.
- What you can do after
- Evaluate/understand SSO choices, including SAML and OIDC tradeoffs and the need for standards-based implementation.
Building Distributed Applications that Work
Single sign-on is an authentication mechanism that lets a user access multiple applications after authenticating once.
- How it is used
- Uses SSO as the shared-identity-provider approach to securing applications in an Aspire ecosystem.
- How deep it goes
- Walks through redirects, token storage, reuse, and expiry at a simplified flow level rather than protocol internals.
- Examples
- Illustrates shared login with a Google account and a protected-page redirect flow.
- What you can do after
- Evaluate/understand how one IdP login grants access across protected applications and when a user must authenticate again.
Read how Building Distributed Applications that Work explains single sign-on →
Related concepts
- identity provideruses · An identity provider is a system that authenticates users or other entities and supplies identity information or authentication assertions to relying applications and services.
- openid connectuses · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
- Security Assertion Markup Languageuses · Security Assertion Markup Language is an XML-based standard for exchanging authentication, identity, and authorization assertions between identity providers and service providers.
- OAuthuses · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
- Terraformused by · Terraform is an open-source infrastructure-as-code tool for defining, provisioning, and managing infrastructure resources through declarative configuration.
- Keycloakused by · Keycloak is an open-source identity and access management platform that provides authentication, authorization, and single sign-on, including support for identity standards and federation.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.