Skip to content

What is Single sign-on (SSO)?

Single sign-on is an arrangement in which one identity provider authenticates a person once and then vouches for them to other applications, so that each application never handles their password.

Updated

  • SSO
  • SAML
  • OIDC
Each organisation connects its own identity provider, matched by email domain.

Operations

Single sign-on (SSO), explained

The two protocols in general use are SAML, an XML-based standard long established in enterprise software, and OpenID Connect, a newer layer over OAuth 2.0 that is simpler to implement and now more common in new products. Most identity providers speak both, and most buyers care only that one of them works.

The security argument for single sign-on is centralisation of control. Password policy, multi-factor enforcement, conditional access and session revocation are configured once and apply everywhere, and an account disabled in the directory loses access to every connected application at the next authentication. The argument against it is concentration of risk: the identity provider becomes the single thing that must not be compromised.

How Enclessa uses it

Enclessa supports single sign-on on the Enterprise plan. Each organisation can connect its own identity provider over OpenID Connect or SAML, matched by email domain, and the owner can require single sign-on for the organisation. Without it, sign-in is by email address and password, with account lockout and session management built in. Passkeys and authenticator-app codes (TOTP) are available as a second factor, and an organisation can require one of administrators and of members with access to Finance or People.