What is single sign-on (SSO), and how does it work?

Single sign-on (SSO) lets a person sign in once and then use many applications without signing in again. Instead of every app keeping its own passwords, the apps trust one identity provider (IdP): the user proves who they are to the IdP, and the IdP vouches for them to each app.

You use SSO every day: signing in to Gmail and then opening YouTube or Google Drive, or signing in to your company portal and opening Slack, Jira and Salesforce without another password.

How SSO works

1. The user opens an app (the service provider or relying party). It has no session for them, so it redirects the browser to the identity provider.
2. The IdP checks whether the user already has a session with it. If not, it shows the sign-in page, with password, passkey, social login or MFA.
3. The IdP sends the browser back to the app with a signed statement of who the user is: an OIDC ID token, a SAML assertion or a CAS ticket.
4. The app verifies the signature and starts its own session.
5. When the user opens a second app, step 2 finds the existing IdP session and skips the sign-in page, so the user lands in the app straight away.

The key point is step 5: the IdP's session is what's "single". Each app still has its own session, which is why single logout (ending all of them at once) needs its own mechanism.

SSO protocols

For anything you build, use OIDC. Support SAML because enterprise customers and SaaS tools will ask for it. See SAML vs OIDC, OAuth 2.0 vs OIDC and what is CAS.

Workforce SSO and customer SSO

• Workforce SSO: employees sign in once to the company's tools. The IdP connects to HR or the directory, and IT turns access on and off in one place.
• Customer SSO: your customers sign in once across your web app, mobile app and support portal, often with social login.
• Enterprise SSO in B2B apps: your customers' employees sign in to your app through their company IdP (Okta, Entra ID, Google Workspace). This is usually what a buyer means by "Does your app support SSO?"

Benefits

• Fewer passwords, so fewer reused and phished ones.
• One place for MFA and policy: require passkeys or TOTP once, at the IdP, instead of in every app.
• Fast onboarding and offboarding: disable one account and access to every connected app ends.
• Fewer password-reset tickets, and an audit trail of who signed in where.

Risks, and how to reduce them

• The IdP becomes a single point of failure and a high-value target. Protect it with MFA, rate limits on failed sign-ins, and high availability.
• Session hijacking gives access to every app. Use short app sessions, secure cookies, and the ability to end sessions centrally.
• Logout is harder than login: plan for single logout, or at least short app sessions, so signing out of the IdP actually takes effect.

Adding SSO with Casdoor

Casdoor is an open-source identity provider that does SSO over every protocol in the table above: OIDC and OAuth 2.0, SAML 2.0 (with single logout and IdP-initiated SSO), CAS, LDAP, RADIUS and Kerberos. When a user who is already signed in opens another application, Casdoor offers to continue as that user, or with Auto signin signs them in without a click. It keeps a session list with device and IP, can sign a user out of all applications at once, and adds MFA, passkeys and social login on top.

It can also accept your customers' or your company's own IdP (Entra ID, Okta, Google Workspace, any SAML or OIDC provider) as an upstream login. See the SSO page, self-host Casdoor for free, or run it on Casdoor Cloud from $24/month billed yearly.

FAQ

Is SSO the same as social login? Social login ("Sign in with Google") is a form of SSO where the IdP is a consumer account provider. Workforce and enterprise SSO use an IdP the organization controls.

Is SSO the same as MFA? No. SSO decides how many times you sign in; MFA decides how strongly. They work best together: one strong sign-in at the IdP.

Does SSO need a directory like Active Directory? No. The IdP can hold users itself, or sync them from Active Directory, LDAP or a cloud directory.

What is an SSO tax? The practice of selling SAML or OIDC SSO only on a vendor's most expensive plan. Open-source IdPs include it.