CYBER SECURITY • IDENTITY AND ACCESS MANAGEMENT

SSO & Federation — Explain single sign-on (SSO) and federation at a high level

How a single authentication event unlocks access across multiple services and organizational boundaries.

Historical Context & Motivation

In the early days of networked computing, each application maintained its own isolated credential store, forcing users to memorize and manage distinct usernames and passwords for every system they accessed. As enterprise environments grew through the 1990s and organizations adopted dozens—sometimes hundreds—of internal and external applications, this fragmented approach created a severe usability burden and a sprawling attack surface. Users resorted to writing passwords on sticky notes, reusing credentials across services, and calling help desks for frequent resets, all of which degraded both security posture and operational efficiency. The concept of single sign-on (SSO) emerged as a direct response to this proliferation of credentials: authenticate once, and let a trusted intermediary vouch for you everywhere else. As the internet matured and business-to-business collaboration became essential, the need extended beyond single organizations to encompass cross-domain trust—giving rise to identity federation. Understanding this evolution is critical because every modern cloud platform, enterprise portal, and consumer service you use today relies on SSO or federated identity in some form.

1993
Kerberos V5 Standardized
MIT's Kerberos protocol was standardized as RFC 1510, introducing ticket-based SSO within a single administrative realm. This gave campus and enterprise users the ability to authenticate once and obtain time-limited service tickets for multiple network resources.
2002
SAML 1.0 Published
OASIS published SAML 1.0 (Security Assertion Markup Language), the first XML-based standard designed explicitly for cross-domain web SSO and federated identity assertions between organizations.
2005
SAML 2.0 & Liberty Alliance
SAML 2.0 merged concepts from the Liberty Alliance's Identity Federation Framework with SAML 1.x, creating a comprehensive standard for browser-based SSO, single logout, and attribute exchange across federated trust circles.
2012
OAuth 2.0 & OpenID Connect
OAuth 2.0 (RFC 6749) provided a delegation framework for API authorization, and OpenID Connect (OIDC) layered an identity and authentication protocol on top of it, becoming the dominant standard for modern web and mobile SSO.
2020s
Zero Trust & Decentralized Identity
Zero Trust architectures made continuous authentication and fine-grained authorization the norm. Emerging standards like W3C Decentralized Identifiers (DIDs) and Verifiable Credentials began to shift federation toward user-controlled, blockchain-anchored identity.

This progression reveals a consistent trajectory: from siloed credentials, to centralized SSO within a single domain, to federated trust across organizational boundaries, and now toward decentralized, user-sovereign identity. The fundamental question that SSO and federation address is: how can we enable seamless, secure access across heterogeneous systems without multiplying the number of secrets a user must manage or an organization must protect?

Core Principles & Definitions

Before diving into protocols and flows, it is essential to establish a precise vocabulary. SSO and federation rest on a small set of interlocking concepts that separate concerns between who authenticates users, who provides services, and how trust is established and conveyed. Mastering these definitions will make every protocol diagram and configuration decision intuitive rather than opaque.

1

Single Sign-On (SSO)

A session and user-authentication mechanism that permits a user to authenticate once and then access multiple independent software systems without re-entering credentials. SSO can operate within a single organization (enterprise SSO) or across organizations (federated SSO).
2

Identity Provider (IdP)

The trusted authority that authenticates users and issues security tokens or assertions. Examples include Okta, Azure AD (Entra ID), and university Shibboleth servers. The IdP owns the credential store and authentication policies.
3

Service Provider (SP) / Relying Party (RP)

The application or service the user wants to access. The SP relies on the IdP's assertions to grant access instead of maintaining its own authentication logic. In OIDC terminology, this is the Relying Party.
4

Federation

A trust arrangement where multiple organizations agree on standards and policies that allow identities issued by one domain to be recognized and honored in another domain. Federation extends SSO across administrative boundaries using shared metadata and trust anchors.
5

Security Token / Assertion

A digitally signed data structure (e.g., SAML assertion, JWT/ID token) that conveys the user's identity, attributes, and authentication context from the IdP to the SP. Token integrity is ensured by cryptographic signatures, and freshness by timestamps and nonces.
KEY TAKEAWAY
Think of SSO like a wristband at an all-day music festival. You show your ID at the gate (the IdP authenticates you), and you receive a wristband (a security token). Every stage, food vendor, and merchandise booth (the SPs) checks your wristband instead of asking for your ID again. Federation extends this further: imagine two music festivals run by different promoters that have a mutual agreement—your wristband from Festival A gets you into Festival B, because both promoters trust each other's entry process.

Visual Explanation — The SSO Authentication Flow

The diagram below illustrates a typical browser-based SSO flow using a centralized Identity Provider. This pattern is common to both SAML 2.0 SP-initiated SSO and OpenID Connect authorization-code flows. Follow the numbered arrows to trace how a user's single authentication event propagates trust to two independent Service Providers.

The flow begins when the user attempts to access Service Provider A (step ①). Because no valid session exists, the browser is redirected to the Identity Provider (step ②), where the user authenticates (step ③). The IdP issues a signed token back to SP-A (step ④), which validates it and grants access (step ⑤). When the user later navigates to Service Provider B (step ⑥), the existing IdP session is reused—the user is never prompted to log in again.

Notice that the credential exchange happens exclusively between the user and the IdP. Neither Service Provider ever sees the user's password—they only receive a cryptographically signed assertion that the IdP has verified the user's identity. This separation of concerns is a cornerstone of SSO architecture: it minimizes the number of systems that handle raw credentials, thereby reducing the blast radius of a credential-store compromise. The IdP maintains an authenticated session (typically via a session cookie), and subsequent SP requests leverage that session to obtain fresh tokens without additional user interaction.

How It Works — Protocols and Token Mechanics

SSO and federation rely on standardized protocols to convey authentication and authorization decisions. While the high-level flow is consistent—redirect to IdP, authenticate, receive token, present token to SP—the wire formats, token structures, and trust establishment mechanisms differ significantly between protocols. Understanding these mechanics is essential for designing, integrating, and troubleshooting identity systems in real-world environments.

SAML 2.0 — Assertion Anatomy

In SAML 2.0, the IdP produces an XML document called a SAML Assertion. This assertion contains three key statements: an Authentication Statement (confirming the user authenticated and how), an Attribute Statement (conveying user attributes like email, role, and group memberships), and an optional Authorization Decision Statement. The entire assertion is wrapped in a SAML Response, digitally signed with the IdP's private key, and posted to the SP's Assertion Consumer Service (ACS) endpoint. The SP validates the signature using the IdP's public key (pre-exchanged via metadata), checks temporal constraints (NotBefore, NotOnOrAfter), and confirms the intended audience.

OpenID Connect — ID Token (JWT) Structure

In OpenID Connect, the IdP issues an ID Token encoded as a JSON Web Token (JWT). A JWT consists of three Base64URL-encoded segments separated by dots: header.payload.signature. The header specifies the signing algorithm (e.g., RS256), the payload carries claims such as iss (issuer), sub (subject identifier), aud (audience), exp (expiration), and iat (issued-at), and the signature is computed over the header and payload using the IdP's private key. The Relying Party verifies the signature by fetching the IdP's public keys from its JWKS (JSON Web Key Set) endpoint.

JWT SIGNATURE VERIFICATION (RS256)
Valid = Verify(PublicKey_IdP, SHA-256(Base64URL(Header) ∥ '.' ∥ Base64URL(Payload)), Signature)
Where denotes string concatenation, SHA-256 is the hash function, and Verify performs RSA PKCS#1 v1.5 signature verification using the IdP's public key. If Valid = true, the token has not been tampered with and was indeed issued by the claimed IdP.

Trust Establishment via Metadata Exchange

Both SAML and OIDC require a pre-established trust relationship. In SAML, the IdP and SP exchange metadata documents—XML files containing entity IDs, public certificates, and endpoint URLs—prior to any SSO transaction. In OIDC, the IdP publishes a discovery document at /.well-known/openid-configuration that specifies the authorization, token, and JWKS endpoints. The Relying Party registers a client_id and client_secret with the IdP. In both cases, the cryptographic material exchanged during configuration is what allows runtime token validation—without it, any party could forge assertions.

💡 SAML vs. OIDC at a Glance
SAML is XML-based, older, and dominant in enterprise/government contexts. OIDC is JSON/JWT-based, lighter-weight, and preferred for modern web and mobile applications. Both achieve SSO, but OIDC also integrates natively with OAuth 2.0 for API authorization, making it the more versatile choice for new projects.

Federation Models & Trust Architectures

While SSO addresses authentication within a single trust domain, federation extends that trust across organizational boundaries. Different federation topologies serve different scales and governance needs. Understanding these models helps architects select the right trust architecture for a given set of requirements—whether connecting two partner companies or linking thousands of universities.

Three federation trust models compared: Point-to-Point is simplest but scales quadratically; Hub-and-Spoke centralizes trust management and scales linearly; Mesh / Trust Framework enables multilateral trust governed by a shared policy, ideal for large-scale inter-organizational federations.
Comparison of federation trust models by scalability, governance, and use case.
ModelTrust LinksGovernanceBest For
Point-to-PointO(n²) — each pair exchanges metadata bilaterallyEach pair negotiates its own policies and contractsSmall partnerships, 2–5 organizations
Hub-and-SpokeO(n) — each org trusts the central hubHub operator enforces common policies; members conformIndustry consortia, national federations (e.g., InCommon)
Mesh / Trust FrameworkO(n) effective, via shared policy anchorFramework document defines rules; all participants self-certify complianceGlobal-scale, multi-federation (e.g., eduGAIN)

Worked Example — Configuring OIDC-Based SSO

Consider a scenario where a mid-size company, Acme Corp, wants to enable SSO for its employees across a project management tool (PM-Tool) using its existing Azure AD (Entra ID) tenant as the Identity Provider. We will walk through the high-level integration using the OpenID Connect Authorization Code flow.

OIDC SSO Integration: Azure AD ↔ PM-Tool
1
Step 1 — Register the Application at the IdPIn the Azure AD portal, Acme's IT admin registers PM-Tool as a new application (Relying Party). During registration, they specify the redirect_uri (e.g., https://pm-tool.acme.com/callback) and configure the requested scopes: openid profile email. Azure AD generates a client_id and client_secret for PM-Tool.
Output: client_id, client_secret, and redirect_uri are recorded on both sides.
2
Step 2 — Discover IdP EndpointsPM-Tool fetches Azure AD's discovery document at https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration. This JSON document reveals the authorization_endpoint, token_endpoint, and jwks_uri (the URL where Azure AD publishes its signing keys).
PM-Tool now knows where to redirect users and where to exchange codes for tokens.
3
Step 3 — User Initiates Login (Authorization Request)An Acme employee navigates to PM-Tool. PM-Tool detects no active session and constructs an authorization URL: GET /authorize?response_type=code&client_id=...&redirect_uri=...&scope=openid+profile+email&state=xyz&nonce=abc. The browser is redirected (HTTP 302) to Azure AD. The state parameter mitigates CSRF attacks, and the nonce is embedded in the resulting ID token to prevent replay.
User sees the Azure AD login page (or is seamlessly authenticated if an Azure AD session exists).
4
Step 4 — Token Exchange (Back Channel)After successful authentication, Azure AD redirects the browser back to https://pm-tool.acme.com/callback?code=AUTH_CODE&state=xyz. PM-Tool's server verifies the state matches, then makes a server-to-server POST to Azure AD's token endpoint, exchanging the authorization code plus client credentials for an ID Token (JWT) and an Access Token.
PM-Tool receives the signed ID Token containing sub, email, name, and nonce claims.
5
Step 5 — Token Validation & Session CreationPM-Tool validates the ID Token by: (a) fetching Azure AD's JWKS and verifying the JWT signature, (b) confirming iss matches the expected issuer, (c) confirming aud equals its own client_id, (d) confirming exp is in the future, and (e) confirming the nonce matches what it sent in Step 3. Upon successful validation, PM-Tool creates a local application session for the user.
The user is authenticated and can use PM-Tool — all without PM-Tool ever seeing a password.

Benefits, Risks, and Mitigations

SSO and federation deliver substantial benefits, but they also concentrate risk in new ways. A security architect must weigh these trade-offs and implement appropriate controls to prevent the IdP from becoming a catastrophic single point of failure. The table below outlines the primary advantages and associated risks, along with recommended mitigations.

SSO benefits, risks, and recommended mitigations.
BenefitAssociated RiskMitigation
Reduced password fatigue — users manage one credentialSingle credential compromise grants access to all federated servicesEnforce MFA at the IdP; implement risk-based step-up authentication for sensitive SPs
Centralized policy enforcement — consistent MFA, password complexity, and session policiesIdP becomes a single point of failure; downtime affects all SPsDeploy IdP in HA (high-availability) configuration with geo-redundancy; implement break-glass local accounts for critical SPs
Faster onboarding/offboarding — disable one IdP account to revoke all SP accessSession propagation delays: user disabled at IdP may retain active SP sessionsShort token lifetimes; implement SAML Single Logout (SLO) or OIDC back-channel logout; enforce SP-side session re-validation
Cross-org collaboration — federation enables B2B and academic resource sharingOver-trust: an SP may receive excessive attributes (privacy risk) or accept assertions from untrusted IdPsImplement attribute-release policies; validate metadata signatures; define minimum assurance levels (e.g., LOA/AAL)
Reduced credential surface — SPs never see passwordsToken theft (e.g., stolen JWT or SAML assertion) can impersonate the userToken binding (DPoP); short expiration windows; audience restriction; transport-layer encryption (TLS)
KEY TAKEAWAY
SSO is analogous to a master key in a building: it dramatically simplifies access management and reduces the number of keys in circulation, but losing the master key (or having the lock-maker's workshop compromised) has far greater consequences than losing a single room key. The mitigation strategy is defense in depth: multi-factor authentication on the master key, short-lived tokens, continuous verification, and an architectural posture where no single component failure cascades unchecked.

Connections to Advanced Theory — Zero Trust & Decentralized Identity

Traditional SSO and federation operate under an implicit assumption: once a user authenticates, they are trusted for the duration of their session. The Zero Trust paradigm challenges this by requiring continuous verification of user identity, device posture, and context for every resource access request—regardless of network location. In a Zero Trust architecture, SSO tokens become inputs to a policy decision point (PDP) that evaluates real-time signals (device compliance, location anomalies, behavioral analytics) before granting access. This shifts federation from a binary 'trusted or not' model toward a continuous, risk-scored trust evaluation.

Traditional vs. Zero Trust approaches to federated identity.
AspectTraditional SSO/FederationZero Trust + Federated Identity
Trust modelAuthenticate once, trust for session lifetimeNever trust, always verify — continuous re-evaluation
Session durationMinutes to hours; governed by IdP session timeoutMicro-sessions; tokens valid for seconds to minutes; step-up auth on demand
Authorization granularityCoarse — role-based, determined at loginFine-grained — resource-level, context-aware (device, location, behavior)
IdP roleCentralized authentication authorityOne signal among many fed into a policy engine (PDP/PEP)
Emerging standardsSAML 2.0, OIDC, WS-FederationCAEP (Continuous Access Evaluation Protocol), Shared Signals Framework, W3C DIDs/VCs

Another frontier is decentralized identity, where users hold their own credentials (Verifiable Credentials) in a digital wallet, and verifiers check them against a distributed ledger or trust registry without contacting a central IdP. This model removes the IdP as a single point of failure and gives users sovereignty over their identity data—a paradigm shift from the centralized federation model. While still maturing, decentralized identity standards (W3C DID, Verifiable Credentials) are being piloted in government digital identity programs and supply-chain trust frameworks, and understanding their relationship to classical SSO will be essential for identity architects in the coming decade.

Practice Problems

PROBLEM 1CONCEPTUAL
Explain the difference between authentication and authorization in the context of SSO. Why is it significant that protocols like OIDC handle authentication while OAuth 2.0 handles authorization, even though they are often used together?
PROBLEM 2BASIC CALCULATION
A university federation has 150 member institutions. If each institution operates both an IdP and one SP, how many bilateral trust links would be required under a pure point-to-point model? How many links are needed under a hub-and-spoke model? Express the ratio.
PROBLEM 3INTERMEDIATE
An OIDC Relying Party receives an ID Token (JWT). Describe the five validation checks the RP must perform before trusting the token, and explain what attack each check prevents.
PROBLEM 4APPLIED
A healthcare company uses SAML-based SSO. An administrator disables a terminated employee's account in the IdP at 9:00 AM, but the employee's browser still has active sessions with three SP applications. The SAML assertions issued to those SPs have a NotOnOrAfter timestamp set to 9:30 AM, and the SPs do not implement Single Logout (SLO). Describe the security exposure window and propose two architectural changes to reduce it.
PROBLEM 5CRITICAL THINKING
Critically evaluate the following claim: 'Decentralized identity (DIDs and Verifiable Credentials) will make centralized Identity Providers and traditional federation obsolete within the next decade.' Consider technical, organizational, and human-factors arguments for and against this position.

Lesson Summary

Single sign-on (SSO) allows a user to authenticate once with a trusted Identity Provider (IdP) and gain access to multiple Service Providers (SPs) without re-entering credentials. The IdP issues a cryptographically signed security token — a SAML assertion or a JWT-based ID Token in OpenID Connect — that the SP validates using the IdP's public key. This separation of concerns ensures that SPs never handle raw passwords, reducing the overall credential attack surface.

Federation extends SSO across organizational boundaries through pre-established trust agreements. Trust can be arranged in point-to-point, hub-and-spoke, or mesh/trust-framework models, each balancing setup complexity against scalability. While SSO and federation deliver enormous usability and security benefits — centralized policy enforcement, faster provisioning, and reduced password fatigue — they also concentrate risk at the IdP, necessitating multi-factor authentication, short-lived tokens, and robust logout mechanisms. Looking ahead, Zero Trust architectures and decentralized identity standards are evolving the landscape toward continuous verification and user-sovereign credentials, building upon the foundational principles covered in this lesson.

Varsity Tutors • Cyber Security • SSO & Federation