Stop 10 · Authentication & AuthorizationTopics · 11/11

Single Sign-On (SSO)

In short

At big companies, employees use twenty internal apps. Twenty passwords would be a nightmare. Single sign-on lets them log in once and walk straight into every app.

Letting a user log in once and gain access to multiple related applications, common in enterprise software using protocols like SAML or OpenID Connect.

The blob character walks down a corridor with one ID card as several doors open.

Think of it like this

One college ID card

Your college ID opens the library, the computer lab and the hostel gate. Each door trusts the card because the college issued it. You never register separately at the library. SSO works the same: one identity provider issues the proof, and every app trusts it.

Watch it happen

Log in once, open two apps

Employee

HR app

Company IdP

Wiki app

open HR app

1/6An employee opens the HR app. They have no session there yet.

The big ideas

What you need to know

One identity provider

The IdP holds accounts, passwords and MFA. Apps never see passwords; they trust the IdP's signed answer.

SAML or OIDC

Older enterprise apps use SAML with XML assertions. Newer ones mostly use OpenID Connect with JSON ID tokens.

Offboarding in one place

Disable an employee at the IdP and they can't sign in to any connected app again.

Logout is the tricky part

Ending the IdP session doesn't end each app's own session. Single logout needs extra work.

See it in code

Walk through the code

1import * as client from "openid-client";2 3const config = await client.discovery(4  new URL("https://login.example.com"),5  process.env.OIDC_CLIENT_ID!,6  process.env.OIDC_CLIENT_SECRET!,7);8 9const verifier = client.randomPKCECodeVerifier();10const loginUrl = client.buildAuthorizationUrl(config, {11  redirect_uri: "https://hr.example.com/callback",12  scope: "openid email profile",13  code_challenge: await client.calculatePKCECodeChallenge(verifier),14  code_challenge_method: "S256",15});16// In /callback: await client.authorizationCodeGrant(config, currentUrl, { pkceCodeVerifier: verifier })

1/4Discovery reads the IdP's /.well-known/openid-configuration, so you don't hardcode its URLs.

Every app in the company follows this pattern with its own client id. The IdP holds the one shared login session.

Save yourself the pain

Common mistakes

Oops

Building separate username and password tables inside every internal app.

Do this instead

Point every app at one IdP. Password resets, MFA and offboarding then happen in one place.

Oops

Assuming that logging out of one app logs the user out everywhere.

Do this instead

Each app has its own session. Keep app sessions short or implement the IdP's logout flow.

Your mission

Try SSO across two apps

~45 min

Quick check

An employee leaves. With SSO, what's the quickest way to stop them signing in to every app?

Go deeper

1Read how SAML and OpenID Connect differ as SSO protocols.
2Understand why enterprise B2B products almost always need to support SSO eventually.
3Recognize this is usually implemented via a managed provider (Auth0, Okta) rather than from scratch.