SSO lets one identity access multiple services, reducing password reuse while making account, session, and identity-provider security critical.
Search across headline titles and summaries.
Background for this topic.
Single sign-on (SSO) lets a user authenticate once with a central identity provider and then access multiple applications without signing in separately to each one. Applications commonly rely on federation protocols such as SAML or OIDC to accept an assertion or token from that provider. SSO centralizes authentication; it does not by itself make every connected application secure or eliminate the need for authorization.
The concentration of access makes the identity provider a high-value target: a stolen password, session, or authentication token may provide access to many services. Phishing-resistant MFA, risk-based access controls, secure token and session handling, and careful configuration of application trust reduce that exposure. Organizations should also monitor provider and federation logs, review which applications can rely on SSO, and promptly disable accounts and sessions when roles change or employment ends. Misconfigured claims or overly broad application permissions can otherwise grant more access than intended.
Hanna Kim to Take Over Login.gov at a Pivotal Moment for Federal Sign-On ServiceLogin.gov, the federal government's single sign-on service, told staffers Wednesday that there would be a change in its top leadership starting next month as the organization ramps up plans to begin testing facial recognition technologies and new pricing models.