SSO
Single sign-on
One sign-in at an identity provider gives access to several applications through a federation protocol such as OpenID Connect or SAML. It concentrates risk in the identity provider, and logout and deprovisioning depend on each application honoring session lifetimes and revocation.
- Defined in
- NIST glossary: Single Sign-On
Covered in
SAML single sign-on: verify signed assertions without losing the identity boundary
Bind a validated SAML assertion to its trusted issuer, the exact signed element, your service, the browser request and a replay record before creating a local session, and keep your SAML library ahead of its advisories.
SCIM deprovisioning: make account disablement remove every usable authority
Connect SCIM resource updates to current sessions, tokens, group-derived permissions and background jobs, with explicit tenant mapping, CAEP revocation events and a measurable revocation contract.
OAuth 2.0 and OpenID Connect login: authorization code with PKCE
Implement OAuth 2.0 and OpenID Connect login with the authorization code flow and PKCE, keep each transaction bound to its browser, and block redirect, mix-up, code-injection and token-theft attacks.
Practice: OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE · Local project: Prove deprovisioning reaches sessions and queued work