IT & Engineering
Single sign-on is the “one ring to rule them all” of internet security. One ring to find them, one ring to bring them all, and bind the other rings through Identity and Access Management (IAM).
Another – less geeky – way to look at it is as a signal of scalability that attracts clients to your application. Why? SSO reduces friction from the very first step – sign up.
Adding SSO to your software or application can be an involved process. In this post, we’ll guide you through the landscape of SSO, and answer some of your burning questions. How does SSO work? What security protocols can you use? And what’s the importance of SSO anyway?
It’s a cry for help at sea. Oh wait…that’s SOS.
SSO is an authentication scheme that enables users to log into multiple applications using a single set of login credentials. It’s a great choice for companies because centralizing authentication processes not only increases security but makes it easier to monitor and maintain. With one complex password, users can log into multiple services from a single platform, eliminating password fatigue; the creation of multiple passwords that need to be securely stored or remembered.
Great question.
Single sign-on is a method of user authentication, and works by sharing and validating login credentials between service providers. Instead of remembering passwords to all your accounts, you can link those accounts to an SSO provider. SSO implementation can be as easy as signing up for a service. With a single SSO login point, you gain secure access to all the subscriptions and applications which have been configured.
If you think about it, SSO isn’t a stand-alone protocol that you insert into your login process as much as it is an independent service with its own database and infrastructure that you integrated with. Single sign-on solutions (also known as identity providers, or IdPs) build a relationship of trust with service providers (SPs) – that is you, or other web-based applications – by keeping the integrity of messages between a service and an identity provider secure using certificates and public key cryptography.
Identity management is great but now we need a way to get login data from point A to point B.
IdPs need a secure way to transmit data. Security Assertion Markup Language (SAML 2.0) is an authentication framework for exchanging identity information between online partners. This is an open standard, which means it’s publicly available and maintained collaboratively by developers around the world.
SAML solves a few key problems for an IdP:
User credentials need to be securely stored and transferred between an IdP and a service. SAML 2.0 is an XML-based framework that manages this data transfer. The user’s browser plays a central role in this exchange of information. Here’s how SAML 2.0 typically works:
The most known protocol supporting SSO is SAML 2.0, but this isn’t the only option. When reviewing options there are two big things to keep in mind. First, whether a company decides to use your application may boil down to the way you integrate with their infrastructure. Second, you’re not limited to only using SAML – you can combine it with something like OAuth to target a wider market.
OAuth 2.0 is a standard protocol for identity authorization. It’s mostly used in organizations where the employees use native applications (mobile and desktop apps). Unlike SAML 2.0, it’s not dependent on the browser to log the user into different applications.
In OAuth 2.0 based SSOs, the most common workflow is a little different compared to SAML-based SSOs. In these SSOs, the client is called one additional time. Here’s how it works:
OpenID Connect (OIDC) is an identity layer on top of OAuth 2.0. It operates like SAML (through authentication tokens and requests). By placing an identity layer on OAuth 2.0, it helps users cater to web-based applications as well as native applications. As opposed to SAML 2.0 which uses tokens, the information here is exchanged in JSON (JavaScript Object Notation), another format for storing data.
We wouldn’t be us if we didn’t weigh the positives and negatives of every tool in our stack, let alone the options we recommend. Here are our top pros and cons.
SSO is a flexible identity management technology that can be configured with other authentication methods such as two-factor authentication (2FA), or multi-factor authentication (MFA). A single source of authentication and user identity management, is SSO too good to be true? Check out our pros and cons below:
| Pros of SSO | Cons of SSO |
|---|---|
| Centralized multi-system management | System lockout if SSO goes down |
| Improved user experience and productivity | Single point of failure in case of breach |
| Reduced strain on IT and Dev resources | Single point of entry in case of breach |
| Increased security and compliance |
We love SSO and think it’s a must for organizations operating online. Let’s look at why.
Access control for applications can be managed centrally by administrators. Users can be grouped in the identity provider with managed permissions. Access to certain applications can be granted to groups or individual end users.
The quickest way to increasing productivity is the path of least resistance. And there’s nothing that takes less time than one touch access. SSO makes user access as easy as opening downloaded applications on your desktop.
SSO also makes life easier for IT. They receive fewer requests for password resets and recovery for multiple apps every week. SSO simplifies revoking access to all a user’s accounts in one fell swoop in case an account is compromised, or an employee leaves the organization.
IdPs reduce, or eliminate, the need for spending dev resources on constructing security management programs in-house. With the configurable nature of SAML and SSO solutions, outsourcing these services are a practical decision with scalable benefits.
SSO is a security focused solution that is configurable and scalable. While it is not currently explicitly required in regulations like GDPR or CPAA, it does make implementing the security standards outlined by those regulations much easier. SSO is built to be adaptable, allowing you to incorporate other security methods such as 2FA as required – and make updates quickly across your company as regulations evolve.
And what about the cons? Ironically, there are a few security things to keep in mind if you’re considering implementing single sign-on.
One of the biggest disadvantages of SSO is that when you log out of one app, you log out of all. Also, if your SSO service is down, you’re locked out of your services, even if all your apps are up and running.
By being the primary source of identity verification in your organization, SSO also becomes a single point of failure. If attackers get to your SSO solutions provider, all your company data will be at risk.
A single point of failure also means a single point of entry for security risks. If one employee’s SSO credentials are compromised, an external threat could very quickly gain access to your entire stack. But, let’s be honest –, that truth is valid even if SSO is not a part of your solution. A compromised password is a compromised password.
The latest authentication techniques such as WebAuthN, Yubikeys, biometrics, etc. are easy to integrate into SSO, and these advanced authentication techniques may not be supported by smaller service providers.
Even though SSO protocols are relatively stable and consistent, there are many SSO providers out there offering slight variations in features, cost, and support. Let’s take a look at a few industry leaders:
Okta supports secure password management, authentication, and authorization for your apps and services. It is customizable and scalable for evolving security programs, and offers an additional layer of security with its ThreatInsights feature that detects malicious IPs across Oktas own customer base.
Auth0 provides authorization and authentication but, historically, is a more developer- focused IdP and may be more flexible and configurable for SMB companies or companies in their startup phase.
OneLogin is comparable to Okta and features easy password generation, a transparent subscription plan, extensive knowledge base and customer onboarding, and expanded global support services.
If you’re in the market for an SSO provider, check out the user reviews for all three as well as Azure AD SSO, Ping Identity, and AWS SSO.
SSO for all.
IdPs solve problems for a variety of use cases – from individuals wanting to manage their personal credentials to companies at all scales. But is particularly useful for these types of organizations:
Companies that have a large portion of their employees working remotely can reduce risks and improve cybersecurity by using SSO in addition to two-factor or multi-factor authentication. Employees logging in from home will have to authenticate their credentials to gain access to the company’s technology stack. Multi-factor authentication will ensure that employee credentials are not misused, and the IT help desk will have the ability to revoke access in case an employee’s credentials are compromised.
Companies that work with a lot of apps and tools can provide a seamless experience for accessing these apps through SSO. These companies can also eliminate the chances of employees being locked out of different apps due to lost credentials.
We’re not just here to feed you a 2000 word sermon on why you should consider SSO.
We do as we preach. Mailgun uses SSO internally to manage our own teams, services, and applications. It’s one of the many ways we keep our data and systems protected.
SSO means ease-of-integration for companies to manage their user identities with their preferred IdP. So, when our user community requested that we implemented SAML single sign-on, it really was an obvious choice.
Integrating with your IdP to authenticate users via SSO is simple. To get started, you’ll just need to configure SAML within your Mailgun account for a verified domain and follow the instructions in our detailed SAML SSO documentation.
This was a long one but we hope it helped.
At Mailgun, we’re always driven by our desire to make our product as usable and accessible as possible, and SSO plays a big role in achieving this. With remote work and the growth of cloud-based solutions, “one ring” to rule your access management is an easy way to integrate and scale complex security. Just make sure that your one ring supports biometrics.
We’re nerds when it comes to security. Don’t believe us? Check out our ebook for the deep dive you didn’t know you were missing.
