What is single sign-on?

/ Interview Questions

Single sign-on (SSO) is a user authentication process that allows a user to access multiple applications with a single set of login credentials.

With SSO, the user only needs to enter their login information once, and they will be automatically logged in to all of the other applications they have been granted access to.

This helps to streamline the login process and makes it more convenient for users, as they don’t have to remember multiple sets of login credentials.

It is common for users to have multiple accounts and passwords for different online services. This quickly become a hassle for users, as they had to remember multiple login credentials and constantly switch between accounts. In response, companies are developing SSO solutions to simplify the login process for their customers.

Advantages of using Single sign-on

One of the main advantages of SSO is that it saves time and reduces frustration for users. Instead of having to remember multiple sets of login credentials, users only need to remember one set of login credentials to access all of their applications. This can also improve security, as users are less likely to reuse passwords or write them down if they only have to remember one set of login credentials.

Another advantage of SSO is that it can improve security by reducing the number of potential vulnerabilities. With traditional login systems, each application has its own login page, which can be a potential target for hackers. SSO centralizes the login process, which means there is only one login page that needs to be secured, rather than multiple login pages.

Disadvantages of using Single sign-on

However, there are also some potential disadvantages to using SSO. One potential issue is that if the SSO system goes down, it can prevent users from accessing any of their applications. Additionally, SSO systems can be complex and may require significant resources to implement and maintain.

Overall, SSO can be a useful tool for streamlining the login process and improving security for users who need to access multiple applications. However, it is important to carefully consider the potential disadvantages and ensure that the benefits outweigh the costs before implementing an SSO system.

How does Single sign-on works?

Single sign-on (SSO) works by allowing a user to authenticate once and then access multiple applications without needing to re-enter their login credentials. This is typically achieved through the use of a central authentication service (CAS), which is responsible for authenticating the user and issuing a token that can be used to access other applications.

There are several different ways that SSO can be implemented, but one common approach is to use the SAML (Security Assertion Markup Language) protocol. In this case, the CAS would be a SAML identity provider (IDP) and the applications that the user wants to access would be SAML service providers (SPs).

Example:

  1. The user attempts to access an application that requires authentication.
  2. The application redirects the user to the SAML IDP to authenticate.
  3. The user enters their login credentials and the IDP authenticates them.
  4. If the authentication is successful, the IDP generates a SAML assertion and sends it to the application.
  5. The application receives the SAML assertion and verifies it using the IDP’s public key.
  6. If the assertion is valid, the application grants the user access.

SAML assertion example:

<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                ID="_593e33ddf86449ce4d4c22b60ac48e067d98a04b"
                IssueInstant="2020-09-22T13:57:31Z"
                Version="2.0">
  <saml:Issuer>https://idp.example.com</saml:Issuer>
  <saml:Subject>
    <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress">
      [email protected]
    </saml:NameID>
    <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
      <saml:SubjectConfirmationData InResponseTo="_738d20ee-fbc7-4c3f-bbe5-84f913cf6b25"
                                   NotOnOrAfter="2020-09-22T13:57:31Z"
                                   Recipient="https://sp.example.com/saml/acs"/>
    </saml:SubjectConfirmation>
  </saml:Subject>
  <saml:Conditions NotBefore="2020-09-22T13:57:31Z"
                   NotOnOrAfter="2020-09-22T13:57:31Z">
    <saml:AudienceRestriction>
      <saml:Audience>https://sp.test.com/saml/metadata</saml:Audience>
    </saml:AudienceRestriction>
  </saml:Conditions>
  <saml:AuthnStatementInstant="2020-09-22T13:57:31Z"
              SessionIndex="_593e33ddf86449ce4d4c22b60ac48e067d98a04b">
    <saml:AuthnContext>
      <saml:Authn>