Single sign-on

As explained in Real-World Cryptography

Single sign-on is an authentication scheme that lets a user access multiple services by authenticating through one account provider.

Single sign-on (SSO) lets one account provider authenticate a user for multiple services, reducing the need to remember or reuse many passwords. section 11.2.1 section 11.4

Common SSO approaches include:

• SAML 2.0, an XML-based protocol still widely used in enterprise settings. section 11.2.1
• OpenID Connect (OIDC), an OAuth 2.0 extension using JSON and common in web and mobile applications. section 11.2.1
• Treat OAuth-based implementations carefully: follow the standards and recommended best practices. section 11.2.1

Connect without another password

A user signs in to Facebook or Google, then connects to Airbnb without creating or remembering a separate Airbnb password. section 11.2.1

Figure 11.3 An example of single sign-on (SSO) on the web. By having an account on Facebook or Google, a user can connect to new services (in this example, Airbnb) without having to think about a new password.

Use the web sign-in flow to see how an existing Facebook or Google account can authenticate access to another service. section 11.2.1

How Real-World Cryptography covers it

How deep it goes

Defines SSO, names SAML and OIDC, and warns about OAuth2 misuse without detailing protocol message flows.

Examples

Uses Facebook or Google authentication to connect a user to Airbnb without another password.

What you can do after

Evaluate/understand SSO choices, including SAML and OIDC tradeoffs and the need for standards-based implementation.

How it connects

Connects SSO with password managers, user authentication, SAML, OIDC, and OAuth 2.0.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersA single sign-on service centralizes user authentication and enables authenticated users to access multiple applications without separately authenticating to each one.
• 

  liveBookmanning.com
  Building Distributed Applications that WorkSingle sign-on is an authentication mechanism that lets a user access multiple applications after authenticating once.

Compare how 3 books explain single sign-on →

Related concepts

• identity provideruses · An identity provider is a system that authenticates users or other entities and supplies identity information or authentication assertions to relying applications and services.
• openid connectuses · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
• Security Assertion Markup Languageuses · Security Assertion Markup Language is an XML-based standard for exchanging authentication, identity, and authorization assertions between identity providers and service providers.
• OAuthuses · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
• Terraformused by · Terraform is an open-source infrastructure-as-code tool for defining, provisioning, and managing infrastructure resources through declarative configuration.
• Keycloakused by · Keycloak is an open-source identity and access management platform that provides authentication, authorization, and single sign-on, including support for identity standards and federation.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.