Single sign-on (SSO)

Single sign-on lets a user authenticate once and then access multiple applications without logging in again. A central identity provider performs the authentication; connected applications receive a signed token or assertion proving who the user is, via protocols such as OpenID Connect or SAML.

SSO improves both usability and security: fewer passwords, one place to enforce strong authentication and to revoke access. The flip side is concentration of risk - compromise the SSO account and you reach everything - which is why the login itself deserves the strongest factors (FIDO2, high-assurance eID).

Frequently asked questions

Identity provider (IdP) Identity federation OAuth 2.0 OpenID Connect (OIDC) SAML 2.0 Access management Strong authentication Electronic identification (eID) DigiD Pseudonym

Back to glossary

Single sign-on (SSO)

Frequently asked questions

Is SSO the same as using one password everywhere?

Is logging in with an eID or a wallet a form of SSO?

What happens if the SSO account is compromised?

What is the difference between an identity provider and SSO?

Does SSO replace access management within an application?

How long does an SSO session last, and does logging out end it everywhere?

Related terms