FresherTechnicalAuthentication & security
What is single sign-on and what does it buy and risk?
Try answering first
Model answer
Single sign-on (SSO) lets a user authenticate once with a central identity provider (IdP), such as Okta, Entra ID or Google, and then access many applications without signing in again. The apps trust a signed assertion or token from the IdP, using protocols such as OpenID Connect or SAML.
What it buys:
- Fewer passwords, so less reuse and fewer reset tickets.
- One place to enforce MFA, password policy and conditional access.
- Fast onboarding and offboarding: disabling one account removes access everywhere.
- A central audit trail of who signed in where.
- Apps no longer store or handle passwords.
What it risks:
- A single point of failure: if the IdP is down, nobody can log in.
- A single point of compromise: a stolen IdP session or admin account opens every connected app.
- Misconfigured trust, such as accepting tokens with a wrong audience or issuer.
- Sessions at each app can outlive the IdP session unless logout is handled.
Takeaway: SSO concentrates risk, so protect the IdP with strong MFA, monitoring and a tested recovery plan.
Key points
- One login at a central IdP unlocks many apps
- Central MFA, policy and offboarding
- The IdP is a single point of failure and compromise
- Apps validate issuer, audience and signature
Likely follow-ups
- What happens to app sessions when a user logs out of the IdP?
- How do you keep access when the IdP is unavailable?
Common mistakes
- Believing SSO removes the need for authorization inside each app
- Not securing the IdP admin accounts with strong MFA