Single Sign-On (SSO) Explained for Absolute Beginners

What is SSO?

Single Sign-On (SSO) is a way to log in once and then access many different apps without having to type your password again for each one.

Think of it like a wristband at a music festival 🎶 — you show your ID once at the entrance, get a wristband, and after that you can walk into any stage, food stall, or VIP area without proving who you are all over again.

Why does SSO exist?

Without SSO, life looks like this:

• A separate username and password for email
• Another one for the project tracker
• Another for the chat app
• Another for the HR portal
• …and 30 more.

This causes three big problems:

1. Users forget passwords — and reuse weak ones across apps.
2. IT teams get flooded with "reset my password" tickets.
3. Security risks grow — every app stores its own copy of your credentials.

SSO solves all three by letting one trusted system handle login for everyone.

How SSO works (the simple version)

There are two main characters in any SSO story:

• 👤 Identity Provider (IdP) — The system you log into. It knows who you are. Examples: Google, Microsoft Entra ID, Okta, Auth0.
• 🧩 Service Provider (SP) — The app you actually want to use. It trusts the IdP. Examples: Slack, Zoom, Jira, your company portal.

The flow goes like this:

1. You open an app (the Service Provider).
2. The app says: "I don't know you yet — go ask the Identity Provider."
3. You log in at the Identity Provider (or it recognizes you from an existing session).
4. The IdP sends back a token — a small, signed digital note that says "Yes, this is Alice, and she's allowed in."
5. The app reads the token and lets you in. No password needed.

That token is the wristband.

   ┌────────┐   1. Open app    ┌──────────────────┐
   │  User  │ ───────────────► │ Service Provider │
   │  (you) │ ◄─────────────── │   (Slack, Jira)  │
   └────┬───┘   5. Access OK   └────────┬─────────┘
        │                               │
        │  3. Log in (once)             │  2. Redirect to IdP
        │                               ▼
        │                       ┌──────────────────┐
        └─────────────────────► │ Identity Provider│
                                │  (Auth0, Okta)   │
                                └────────┬─────────┘
                                         │
                                         │ 4. Issue token
                                         └──► back to the app

Common SSO standards

You'll hear these names a lot — don't worry about the details yet, just recognize them:

• SAML 2.0 — the older, XML-based standard. Still very common in enterprises.
• OAuth 2.0 — technically about authorization (giving apps permission), but often used in SSO setups.
• OpenID Connect (OIDC) — a modern authentication layer built on top of OAuth 2.0. This is what most new apps use.
• Kerberos — used inside corporate networks (e.g. logging into a Windows domain).

What SSO is NOT

• ❌ SSO is not a password manager. A password manager fills in many different passwords for you. SSO removes the need for them.
• ❌ SSO is not the same as MFA. MFA (Multi-Factor Authentication) adds an extra step like a phone code. SSO and MFA work together — you usually do MFA once at the IdP, and SSO carries that trust to every app.
• ❌ SSO is not "log in with Google" only. "Log in with Google" is one example (social login), but SSO is the broader idea.

Benefits at a glance

• ✅ One password to remember
• ✅ Faster access to all your tools
• ✅ Fewer "forgot password" headaches
• ✅ Stronger security (one well-protected login, plus MFA)
• ✅ Easier for IT to add/remove users — disable them in one place and they're locked out of everything

The trade-off

SSO is powerful, but it concentrates risk: if someone steals your SSO credentials, they may get into everything. That's why SSO is almost always paired with:

• MFA (a second factor like a code or fingerprint)
• Session timeouts
• Anomaly detection (alerts on weird login locations)

TL;DR

SSO = log in once, use everything. An Identity Provider vouches for who you are, apps trust that vouching, and you skip the password prompt everywhere else.

That's it — you now understand the core idea behind SSO. 🎉

---

Got questions or want a follow-up post on SAML vs OIDC, or on setting up SSO with Auth0? Drop a comment below!