Digital Lexicon Hub

An authentication arrangement that allows a user to access multiple applications through one identity-provider session.

SSO reduces password fatigue and help-desk resets, lets IT enforce MFA and access policies in one place, and makes offboarding faster because disabling one identity cuts access to every connected app.

A 200-person company connects Google Workspace, Slack, HubSpot and its HR system to Okta using SAML and OIDC, enforces MFA at the identity provider and blocks a leaver's new sign-ins to every connected app with one account suspension.

The identity provider becomes a single point of failure and a high-value target; a compromised session can open many apps. Older apps may not support SAML or OIDC, and some vendors charge extra for SSO features.

The user authenticates with an identity provider (IdP), which issues a signed assertion or token that service providers (SPs) trust. SAML 2.0 uses XML assertions passed through the browser, while OpenID Connect adds an ID token on top of OAuth 2.0. Each app then creates its own local session, and protocols such as SCIM often handle user provisioning alongside SSO.