Single sign-on

As explained in Software Security for Developers

A single sign-on service centralizes user authentication and enables authenticated users to access multiple applications without separately authenticating to each one.

Single sign-on (SSO) lets a user authenticate once and access multiple applications without separately logging in to each one. An identity provider (IdP) handles authentication for those applications and issues proof of identity. section 12.4 section 12.5

Externalizing authentication avoids making every application store passwords and independently implement login security. It also lets multiple applications reuse centralized authentication logic and gives users a more consistent login experience. section 2.1 section 12.4

SSO can support several organizational and user-facing arrangements:

• Customer applications can offer username-and-password login, social login, biometric authentication, or password-based multifactor authentication through the SSO service. section 2.1.1
• Corporate SSO can connect employees to internal applications, customer-facing employee interfaces, and external SaaS applications using unified directory credentials. section 2.1.2
• Partner authentication can be delegated to a partner’s SSO service, allowing access to ACME systems to end when the partner revokes access. section 2.1.3
• Organizations can choose a managed SaaS service, a self-run commercial or open-source service, or a custom SSO service. section 2.1.1

OAuth2 and OpenID Connect (OIDC) provide standard ways for applications to delegate login to an SSO service. OIDC adds user identity information to OAuth2, while WebAuthn supports biometric login and phishing-resistant physical security keys. section 2.1.5 section 13.0

One login across a workday

An employee uses document, transaction, work-hours, and other applications throughout the day. Instead of authenticating separately to each application, the employee signs in through the corporate SSO service and reuses that authenticated session. section 12.0

Figure 2.3 An SSO service handles user account creation and authentication. Multiple applications can use the same SSO service, simplifying security for application developers. The SSO service supports authentication using OAuth2, OIDC, WebAuthn, and password-based multifactor authentication.

Shows how an SSO service handles account creation and authentication for multiple applications, including OAuth2, OIDC, WebAuthn, and password-based multifactor authentication. section 2.1.1

How Software Security for Developers covers it

How deep it goes

Explains SSO architecture, deployment choices, federation, protocols, and tokens, while deferring detailed SAML and LDAP treatment.

Examples

Uses customer social login, employee corporate applications, partner access delegation, and unified login across multiple work applications.

What it assumes

Assumes application-security foundations including TLS, JOSE, X.509 certificates, and public-key infrastructure.

What you can do after

Apply SSO by integrating applications with an IdP through OIDC, OAuth2, or WebAuthn.

How it connects

Connects authentication with identity providers, OAuth2, OIDC, WebAuthn, multifactor authentication, federation, tokens, and access control.

liveBookmanning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Real-World CryptographySingle sign-on is an authentication scheme that lets a user access multiple services by authenticating through one account provider.
• 

  liveBookmanning.com
  Building Distributed Applications that WorkSingle sign-on is an authentication mechanism that lets a user access multiple applications after authenticating once.

Compare how 3 books explain single sign-on →

Related concepts

• identity provideruses · An identity provider is a system that authenticates users or other entities and supplies identity information or authentication assertions to relying applications and services.
• openid connectuses · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
• Security Assertion Markup Languageuses · Security Assertion Markup Language is an XML-based standard for exchanging authentication, identity, and authorization assertions between identity providers and service providers.
• OAuthuses · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
• Terraformused by · Terraform is an open-source infrastructure-as-code tool for defining, provisioning, and managing infrastructure resources through declarative configuration.
• Keycloakused by · Keycloak is an open-source identity and access management platform that provides authentication, authorization, and single sign-on, including support for identity standards and federation.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.