Single Sign-On

Overview

Single sign-on (SSO) is a method by which a user logs in once and can then access multiple services withour re-authenticating for each. A typical SSO authentication process involves the following three parties:

• Principal/Subject. The entity trying to access an application or service.
• Identity Provider (IdP). A service that stores and confirms user identity, typically through a login process.
• Service Provider (SP). The service the user wants to use.

Generally speaking, SSO is focused on authentication, i.e. determining a user's identity. It is not focused on authorization, i.e. the user's privileges and/or permissions.

SAML

TODO

OIDC

OpenId Connect (OIDC) is a protocol built on top of OAuth to provide authentication-related functionality. The OAuth flows are largely the same. When the authorization server issues an access token, it also issues an ID token (a JWT) and an optional refresh token.