SSO
SSO (single sign-on) is an authentication setup in which a user signs in once at an identity provider and then reaches many applications without signing in again, because each application trusts a signed SAML assertion or OIDC ID token from that provider instead of checking its own password. The application finds the user by the SSO identifier in that assertion or token.
| SSO is | SSO is not |
|---|---|
| One sign-in session at the IdP reused across apps | A password manager that fills a different password into each app |
| Built on federation standards (SAML 2.0, OpenID Connect) | MFA by itself, although it is where MFA is enforced |
| Paired with SCIM for account creation and removal | Account provisioning: SSO authenticates, it does not deprovision |
SSO is the highest-impact control in workforce identity and the one that concentrates risk: one credential now opens everything behind it, so the session lifetime, the strength of the factor, and the detection around the identity provider all matter more than they did before. Nearly every large breach of the past three years reached SSO credentials first and used them normally.
See also: federation, identity provider, SAML vs OIDC, IAM vendors, SSO tax, SSO enforcement, local login bypass, best SSO providers for SMBs
Related on Start with Identity
- GlossaryRelying Party (RP)
The application that relies on an external identity provider to authenticate users. The term is used in OIDC and WebAuthn. The RP validates tokens or assertions
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
- BlogGitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoning
GitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-li
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan