Implementing Single Sign-On (SSO)
1. Understanding SSO Concepts
| Concept | Detail |
|---|---|
| Goal | One auth session covers multiple apps |
| IdP | Central authentication authority |
| SP / RP | Applications consuming SSO |
| Session propagation | Cookie at IdP + per-RP local session |
2. Implementing SAML-Based SSO
| Step | Detail |
|---|---|
| Metadata exchange | SP + IdP swap XML metadata |
| AuthnRequest | SP redirects browser to IdP SSO URL |
| Assertion | POSTed to SP ACS |
| Library | passport-saml, spring-security-saml, python3-saml |
3. Implementing OAuth/OIDC-Based SSO
| Aspect | Detail |
|---|---|
| Protocol | OIDC Authorization Code + PKCE |
| SSO session | IdP cookie reused across RPs |
| Discovery | /.well-known/openid-configuration |
| Library | oidc-client-ts, AppAuth, Spring Security OAuth2 |
4. Using Enterprise SSO
| Vendor | Protocols |
|---|---|
| Okta | SAML, OIDC, WS-Fed |
| Azure AD / Entra ID | SAML, OIDC, WS-Fed |
| Auth0 | OIDC, SAML |
| Ping Identity | SAML, OIDC, OAuth |
| Keycloak | OIDC, SAML (self-hosted) |
5. Implementing Session Propagation
| Approach | Detail |
|---|---|
| Shared cookie domain | Cookies on .example.com shared across subdomains |
| Token in URL | Single-use code redirect |
| SSO session at IdP | Each RP exchanges code for own session |
| BFF | Backend-for-Frontend holds session, serves SPA |
6. Handling Cross-Domain SSO
| Challenge | Solution |
|---|---|
| Third-party cookies blocked | Back-channel logout, server-side polling |
| Cross-origin requests | CORS + postMessage between origins |
| CSRF | state + nonce + PKCE |
| Mobile | System browser / ASWebAuthenticationSession |
7. Implementing SSO Logout
| Type | Behavior |
|---|---|
| Local | Clear app cookie only |
| Single Logout (SLO) | Terminate IdP + all RP sessions |
| Back-channel | OP POSTs logout_token to each RP |
| Front-channel | Hidden iframes per RP (cookie-restricted) |
8. Using Identity Federation
| Aspect | Detail |
|---|---|
| Definition | Trust between IdPs across organizational boundaries |
| Standards | SAML federation, OIDC federation, WS-Federation |
| Hub-and-spoke | Central broker (Auth0, Keycloak) bridges providers |
| Example | "Sign in with Google" delegates AuthN to Google |
9. Implementing Just-In-Time Provisioning
| Step | Detail |
|---|---|
| First SSO login | SP receives assertion / id_token |
| Lookup | By external ID (sub / NameID) |
| Not found | Create local account from claims (email, name, groups) |
| Update | Sync attributes on subsequent logins |
| Alt: SCIM 2.0 | Push-based provisioning (RFC 7644) |
10. Handling SSO Failures and Fallbacks
| Failure | Response |
|---|---|
| IdP down | Cached session continues; new logins blocked |
| Metadata stale | Periodic refresh (daily) |
| Cert rotation | Trust both old + new during grace |
| Break-glass | Local admin account (MFA-protected) |