Single Sign-On (SSO) is a modern authentication method that allows users to access multiple applications with a single set of credentials. It can eliminate the need for users to remember multiple usernames and passwords, thus streamlining the login process and enhancing security. All this is related to the broader field of analyzing various identity management systems and IM environments. And here is how it all works.
- Single Sign On (SSO) – How does it work?
- What are Identity Federations?
- Advantages of single sign on
- Is it safe to log in to a website with Google or Facebook?
- Why is single sign on important – the conclusion
Single Sign On (SSO) – How does it work?
Glossary:
Resource provider (RP) – an individual or a business that provides an online service such as a website to the end users. In the case of SSO, the resource provider relies on a trusted identity provider for the user authentication process.
Trusted identity provider (TIP) / identity provider (IP) – an identity provider acts as an authority that is able to authenticate users and prove their identity to the resource providers using signed identity tokens. One identity provider can handle the authentication process for hundreds of different resource providers. Ex. of trusted identity providers include: Google, Facebook, Twitter, etc.
How Single Sign On (SSO) functions, is that when a new user is trying to create an account in an online service that makes use of SSO capabilities, he is prompted to try and log in using another kind of existing account from a chosen service the resource provider trusts and the user is already registered in (for example a Google account).
If the user decides to do just that, the actual resource (service) provider is in this case entrusting the whole authentication process to the third party service (a trusted identity provider) which might be Google, Facebook, Twitter, etc.
In the end, the user that decides to authenticate using the proposed SSO solution, is authenticating using the trusted identity provider infrastructure, rather than that of the service he’s effectively logging into.
The identity of the end user is provided to the resource provider using a signed digital token after successful authentication. In most cases the token is passed from the trusted identity provider to the user, and then onto the resource provider’s server.
As the trust between the identity provider and the resource provider is already established, the resource provider is able to successfully allow you to authenticate using the signed token.
The resource provider is in this case free of the responsibility of handling authentication directly via local means of trust management. This situation is therefore convenient for all the parties involved.
The SSO can ensure that you can access many different online services after authenticating with your identity provider just once, provided that all said services trust it.
Of course, many sites these days offer both SSO and their own authentication, for the sake of the end user’s convenience.
One type of standard that can handle SSO capabilities is the ever-popular OAuth you might have already heard about.
There are many different popular services that make use of single sign on capabilities including Microsoft 365, Salesforce, Google Workspace, Quora and more.
Examples of standards used in SSO operations include: Shibboleth, SAML (Security Assertion Markup Language), and OIDC (OpenID Connect). These standards define the protocols and technologies used to exchange authentication and authorization information between federated resource providers.
What are Identity Federations?
Identity federation is a centralized way of managing identities and authentication information across multiple, disparate systems. It’s essentially a situation where multiple resource providers put their trust in a single trusted identity provider.
Identity Federations use a trust relationship between different organizations, to allow users to access resources and services in a secure and seamless manner, without the need for multiple user accounts, usernames and passwords. The main goal of an Identity Federation is to simplify the authentication process for end-users, while also providing a secure and scalable way for organizations to manage access to their systems and data.
So, in summary, an identity federation is a body of different resource providers (for example services that make use of SSO methods) trusting a centralized trusted identity provider or central identity provider (such as Facebook or Google).
The role of a centralized identity provider is to provide signed and trusted identity tokens that can be parsed by different resource providers to authenticate their users.
All services trusting a single identity federation are able to provide users an opportunity to switch between their sites/services/apps without ever needing to re-enter their credentials.
Advantages of single sign on
Making use of single sign on capabilities has a lot of advantages, many connected with increased data safety and end user convenience. Here are a few of most prevalent pros of utilizing SSO on your website.
- Improved user experience: Single Sign-On eliminates the need for users to remember multiple usernames and passwords, leading to a simpler, faster and more user-friendly login experience.
- Increased security: SSO can reduce the risk of password-related security breaches by requiring users to authenticate using the trusted identity provider’s infrastructure which in case of most popular TIP-s such as Google, maintains very high levels of data storage security and is less likely to suffer from an unwanted user data exfiltration of any kind.
- Centralized management: SSO provides organizations with a centralized way to manage authentication and authorization for all their systems, applications, and services, which makes it easier to enforce security policies and manage user access.
- Easier compliance with data safety regulations: SSO can help organizations meet regulatory requirements by providing a secure and auditable way to manage user access to sensitive information. Not storing user passwords on your servers can relieve you of some duties when it comes to direct user data protection. This of course is only the case if you don’t already provide local authentication means and don’t store other kinds of user credentials on your servers.
- Reduced management costs: SSO can help organizations reduce the costs associated with managing multiple authentication systems and managing user accounts alongside with user credentials and related data.
While not all users favor signing into a service using a 3rd party account, many of them will welcome this solution as one that simply makes the authentication process faster and eliminates the need of remembering another lengthy password. While keeping all this in mind you should always consider having a fallback method of authentication to your service and not relying on SSO alone.
Is it safe to log in to a website with Google or Facebook?
While using a third-party service, such as Google or Facebook to log in to a website can be convenient and save you time, some users might still be reluctant to entrust the authentication process to a 3rd party.
While authenticating via a trusted identity provider is by definition as safe as the TIP handling the process makes it, the end user’s lack of trust is most commonly connected with trusting the TIP with other kind of data than their sole credentials.
For instance, authenticating in a service “A” using your chosen TIP account, will in most cases let the TIP know that your account is accessing said service “A” in one way or the other. While by definition most of this data is private, it may be sold to advertisers or logged depending on the chosen TIP and its user data management policies.
A common example of this kind of situation is a user refusing to sign into a service using a Google account, with the reasoning being that he doesn’t want Google to make an unnecessary connection between him and the service in question.
This simply has to do with the trust level between the end user and the chosen TIP, and the actual data management policies of said TIP. A user that is left to authenticate via TIP whom he doesn’t trust might be reluctant to do so. This topic is left up to a discussion depending on the TIP in question.
Why is single sign on important? – the conclusion
Utilizing SSO can help organizations to meet regulatory requirements, reduce costs associated with managing multiple authentication systems, and improve overall security, efficiency, and user satisfaction.
All in all, whether you decide to rely solely on SSO and trusted identity providers for your users authentication, or use SSO as a fallback log in method, it can still be beneficial for your end users who’ll in the end decide to make use of the feature.
We hope we helped you learn more about how single sign on systems work, how you can benefit from implementing SSO in the web services you provide. Now you should be much more familiar with SSO, identity federations and identity management systems overall. Until next time!
