SSO · Single Sign-On
Single Sign-On
What is SSO?
- One login, many services
- Convenience + central security
- Pair it with 2FA
Adding SSO does more than reduce the number of login screens. The authority to decide “who is this person” moves from each individual service to a single identity provider (IdP). Groupware, the HR system, and the sales tool no longer verify their own passwords; they open the door by trusting the authentication token the IdP signs and sends. As a result, most of the real project work goes into account and permission design (deciding who gets which access and managing it in one place) rather than connecting screens.
The method depends on the use case. Internal web systems and enterprise SaaS use SAML 2.0; mobile apps and cloud APIs use OIDC, which is built on OAuth 2.0; and Windows AD domains use Kerberos internally. Google and Kakao logins are just consumer applications of OIDC, not the same thing as enterprise SSO. Browser autofill and password managers only type in your ID and password for you; the authenticating party doesn’t change, so they are not SSO. To have account creation and deletion flow through automatically as well, you need to add a provisioning standard such as SCIM separately.
The most common mistake in the field is assuming that “we disabled the departed employee’s account, so we’re done.” Even after you deactivate an account in the IdP, access tokens already issued and each service’s own session stay alive, so depending on configuration, documents can still be downloaded for anywhere from tens of minutes to several hours. Logout works the same way: signing out of the portal does not sign you out of each service, so you have to turn on Single Logout (SLO) separately. The IdP is also a single point of failure: if it goes down, no employee can get into any system. And adding SSO without 2FA widens the damage when a single account is compromised. Legacy systems that don’t support SAML will end up keeping separate IDs, so it’s safest to factor that in from the start.
Seolyeong ParkGenerative AI and AX training expert with 17 years of hands-on experience and 200+ sessions, making AI usable right away even for non-specialists
Seungtae ParkPractical AX instructor who teaches by building AI business development and marketing automation hands-onIt grew out of the need to manage access to many systems within a company, and became a standard authentication method as cloud services spread.
Consider a hypothetical case. Company A, a medical device distributor with 320 employees, has grown to 14 SaaS tools over the past three years. Because each service had its own password, 68 reset requests a month piled up on the IT team, and an internal audit flagged that a departed employee’s account had stayed active for more than two months. Management ordered SSO to be rolled out within three months.
- The project began when the information security lead pulled three months of help desk tickets and reported to the management meeting that “password resets run 68 a month and take an average of 12 minutes each.”
- An IT operations manager picked the 9 of 14 SaaS apps that support SAML 2.0 as the first integration targets and cut the 2 legacy inventory systems that don’t from the scope, saying, “not this time.”
- An HR manager and the security team cut the permission groups, organized by department and job level, from 31 to 11, and connected the HR system to the IdP so that accounts are created automatically via SCIM as soon as a new hire is registered.
- In week 2 of the pilot, the sales team reported that “we logged out of the portal, but the CRM is still open,” so Single Logout (SLO) and a 30-minute session timeout were quickly added to the configuration.
- MFA was made mandatory for all 320 employees, but re-authentication was deferred for 12 hours on the company network and on registered devices, which calmed the pushback from staff who said, “we can’t enter a code several times a day.”
- Three months after rollout, password-reset requests fell from 68 to 9 a month, and departed-employee account removal went from an average of 6 days to same-day processing.