A guide to single sign-on (SSO): What it means and how it works

Every app, website, and platform requires some form of authentication to grant access. That means users have to remember more passwords than ever, making it tempting to set an easy-to-remember (a.k.a. weak) password or duplicate passwords across multiple sites.

Single sign-on (SSO) authentication is a centralized login system, using one set of login credentials across multiple different apps. This provides companies with enhanced security (as users are using their existing credentials) while also providing end users with a great experience.

But, SSO authentication has its drawbacks, particularly if best practices aren’t followed. Luckily, there are plenty of safeguards and extra layers of protection you can use alongside SSO authentication to enhance your app’s security.

Single sign-on (SSO) is a type of authentication practice that lets users securely log in to multiple applications using one set of login credentials.

You’re likely already using SSO in your daily routine. Take work as an example: you’re probably using a stack of different apps from Slack to Gmail to Clickup and beyond. Password management best practices require you to set unique credentials for each platform. But that can quickly get tedious and time-consuming, especially if you need to reset each password every few months.

Outside of the office, you’ll likely encounter the same scenario. Every social media platform, email provider, app, and online banking platform will need its own credentials. Remembering strong passwords can be challenging, and storing them securely can be costly, too.

That’s the big drawcard for single sign-on. SSO directs you to a login page where you can access this site using an existing set of credentials. That could be using your Google account to sign up to a new app or using your Facebook credentials to access a new platform.

It fast-tracks the sign-up and log-in experience and removes the need for companies to set up their own password management infrastructure.

SSO is based on the federal identity system which relies on trust between a service provider (SP) and an identity provider (IdP). A certificate is exchanged between the IdP and the app which is used to signal identity information being sent between the two. This guarantees that the service provider knows this information is coming from a trusted source.

Once a user has established trust with one app or service they are granted access to all other applications that have also established a trusted relationship.

SSO works through tokens that contain identifiable information (usually a user’s email address) about the user which confirms the user’s identity and grants access. To establish that token is coming from a trusted source, the tokens have to be digitally signed and a certificate is used during the exchange.

The SSO login flow uses identity data about a user (in the form of tokens) which follows this process:

1. A user logs into an app and an SSO token is created and sends an authentication request to the SSO provider.
2. The SSO provider then sends a token that contains identifiable information about the user to the SSO system. If the user is authenticated, the IdP sends a confirmation to the app to provide access.
3. If the user isn’t validated, the user will be redirected to log in by entering a set of login credentials (such as a username and password). Sometimes, this can include using multi-factor authentication through a magic link or one-time password (OTP).
4. A positive response is then sent to the particular app once the SSO server authenticates the user’s login credentials.

SSO isn’t the only identity and access management (IAM) option you can choose from. It all really depends on what you’re looking for and what your app’s specific needs are.

It can be helpful to understand how SSO measures up against other IAM solutions to make an informed decision about whether this approach is right for you.

Same sign-on, otherwise known as directory server authentication, allows you to synchronize your user login credentials on the particular user’s device from a directory server.

This process is similar to password vaults like LastPass and Keeper which gives users the ability to sign in on multiple platforms and apps without having to remember all their passwords.

Federated identity management (FIM) is a unique user’s digital identity. It’s made up of a set of attributes and characteristics that defines each unique user as they interact with applications and platforms.

FIM establishes trust between different entities based on agreement on the user’s characteristics. Since FIM is based on mutual trust, for it to work successfully, each trust domain must be interconnected through a third-party service (an identity provider) that stores users’ login details securely.

Multi-factor authentication (MFA) uses more than one authentication factor to authenticate a user’s identity. By combining authentication factors, MFA is one of the strongest forms of authentication available, making it a preferred choice for apps handling sensitive user data.

The key to getting MFA right is to ensure you’re leveraging a range of different authentication factors, from possession factors to inherence factors. This could look like using a username and password as well as a fingerprint scan or sending users a time-sensitive OTP.

Alternatively, you can use an authenticator app that has a unique set of numbers that can be used to authenticate the user or even use pins and secret questions that only the user would know.

SSO is a great tool for improving an app’s user experience without compromising on security. But, there are also some drawbacks and trade-offs when choosing this form of authentication.

From streamlined access to reducing the need to remember different passwords for multiple apps and websites SSO authentication offers a stack of benefits.

• Streamline access to applications: with SSO, users can easily access all the platforms and applications with ease. This improves productivity and workflows and ultimately enhances the user experience.
• Reduce password fatigue: by using SSO users only have to remember one password, which can ultimately strengthen password security and reduce password fatigue. This means users can create stronger passwords, rather than creating multiple ‘easy’ to remember passwords that are insecurely stored or reused time and time again.
• Improved admin control: SSO gives great control and visibility to IT administrators regarding what platforms and apps are being used within an organization. Administrators can also remove access to certain apps in the event of a user losing their devices. Plus, using SSO means IT departments spend less time on password recovery and resetting for multiple apps, platforms, and users.
• Greater security: SSO reduces the risk of attacks by decreasing the need for users to create and remember multiple passwords. On top of that, admins can view and change access levels with ease which further enhances security. Using MFA in combination with SSO can increase security and protect companies and apps from attackers, too.

Although SSO has a stack of benefits, it also comes with drawbacks that can leave companies and apps vulnerable to attacks. Usually, these issues crop up when SSO isn’t implemented properly or best practice guidelines aren’t followed.

But it’s important to understand the limitations of SSO so you can make an informed decision.

• Increases the likelihood of password vulnerabilities: since users only have to remember one password for SSO, their passwords have to be very strong to reduce password vulnerability and make sure that it’s well-protected. If the user forgets the password or it becomes compromised it essentially cancels out the benefits of SSO.
• SSO requires an IdP: SSO requires the organization’s IdP which means companies have to pay for separate solutions. This can be a potential cost burden for businesses, particularly for small organizations as you have to pay for both the setup costs and all recurring costs to keep using it.
• All resources connected to an SSO provider are open to attacks: if the SSO provider is attacked or an attacker gains access to a user’s login credentials they will also have access to all apps and platforms the user has access to. If organizations aren’t using MFA in combination with SSO this leaves the organization vulnerable to their data being compromised.

SSO can enhance an app’s security, particularly when combined with MFA. SSO simplifies the login process and password management for users and admins. Instead of having to remember multiple passwords, writing them down, and re-using old passwords, users remember a single, more secure password.

61% of attacks on a company come down to weak or compromised login credentials. SSO can significantly decrease the number of attacks because users only log in once per day with only one set of credentials, narrowing the window of opportunity for intruders.

Plus, in the event of malicious activity, or stolen or lost devices, admins can remove access for a particular user before someone has the chance to access all the apps and platforms related to that device or user. Admins can also remove access to users who’ve left an organization with ease.

Admins also have greater control over setting complex and secure passwords and can use MFA or two-factor authentication (2FA) to further increase security.

With so many SSO providers on the market, choosing the right SSO provider for your particular company or app depends on what suits your particular needs and long-term business goals. But, you’ll want to look out for a few key things when weight up and comparing SSO providers:

• MFA integration: to best protect your company, you’ll want to look for SSO providers that integrate an MFA solution. This way you’re not exclusively relying on credentials to provide authentication and strengthen the security of your organization.
• Access to a range of applications: when looking for an SSO provider, look for ones that support integrations with a range of apps. You want to ensure your SSO provider has integrations with SaaS tools, a variety of social platforms, and web applications.
• Customization: you’ll want your SSO provider to give you access to a single dashboard that gives you visibility of all the apps you have access to and be customizable to your business needs.

If you’re weight up which SSO protocol to use, it’s best to keep things simple. The main options tend to be OpenID Connect, Facebook Connect, SAML, and Microsoft Connect, just to name a few. Some protocols will be better suited to enterprise-level apps (such as SAML) while others will offer more flexibility for earlier-stage companies.

Authentication with Kinde increases your security and enhances the user experience by using credentials from all the best platforms on the market including Google, Slack, Apple and more.

Reduce manual tasks by easily onboarding your team and increasing control and visibility with a customizable single dashboard where you can authorize your users’ access to apps and platforms.

For enterprises looking to support their biggest customers, Kinde offers MS Azure AD enterprise authentication with flexible and customizable connections and a seamless sign-in process designed to support all the applications and objects you need through a single dashboard.

SSO can help both enterprises and smaller companies balance their security needs while enhancing the user experience. If you’re looking to increase security further, using MFA alongside SSO can provide an extra layer of protection and safeguard against potential malicious activity.

See how Kinde compares to other authentication providers.