Single sign-on lets a person authenticate with one trusted identity system and then access multiple connected applications.
Single sign-on (SSO) is an authentication pattern in which one identity provider verifies a user and connected applications accept that result.
The user does not need to enter a separate application password every time they open another connected service. Each application still creates or uses its own session after it validates the sign-in result.
Think of SSO like one trusted front desk that issues a badge accepted by several buildings.
You prove who you are at the front desk once. When you visit another connected building, it checks the trusted badge instead of asking you to repeat the full check.
SSO coordinates the authentication handoff between a user, a central identity provider, and multiple applications.
Keep the main identity check in one trusted service.
Tell an application which verified user is requesting access.
Apply shared sign-in rules such as MFA or device checks.
Give users fewer application-specific passwords to manage.
SSO is useful when one organization or platform manages access to several related applications.
Employees use one organization account across email, analytics, and internal systems.
A customer uses one account to reach several products from the same provider.
Students and staff access learning, library, and administrative tools through one identity.
A trusted partner identity can be accepted by a shared business application.
1. The employee opens the dashboard and is redirected to the company identity provider.
2. The identity provider checks the existing sign-in and any required MFA policy.
3. The provider returns a signed result to the dashboard.
The dashboard validates the result, identifies the employee, and creates an application session.
The user can now use the dashboard without entering a second dashboard password.
SSO removes repeated sign-in steps; it does not remove the need for each application to validate the identity result and enforce its own access rules.
The identity provider authenticates the user. The application validates the returned result, establishes its session, and then applies authorization rules such as roles and permissions.
SSO is the user experience and architecture of signing in once across applications. OAuth is an authorization protocol for delegated access.
A password manager fills separate credentials. SSO lets connected applications trust one identity provider.
SSO helps establish identity. Authorization decides what the identified user may do inside an application.
One sign-in does not automatically grant the same permissions in every connected application.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| Single Sign-On (SSO) | 单点登录 | One sign-in that can open several connected applications. | 登录一次后，可以进入多个互相信任的应用。 |
| Identity Provider | 身份提供商 | A service that verifies identity and provides sign-in results. | 负责验证身份并告诉应用“这个人是谁”的服务。 |
| Authentication | 身份验证 | Checking who a user or system is. | 确认用户或系统到底是谁。 |
| Authorization | 授权 | Checking what an identified user is allowed to do. | 确认已经识别出的用户可以做什么。 |
| Application Session | 应用会话 | The application’s record that a user has signed in. | 应用保存的“这个用户已经登录”的状态。 |
| Multi-Factor Authentication (MFA) | 多因素认证 | Sign-in that uses more than one kind of proof. | 登录时需要两种或更多不同类型的证明。 |
| Assertion | 断言 | A signed statement about an authenticated user. | 由可信身份系统签名、说明用户身份的结果。 |
| Role | 角色 | A named set of responsibilities or permissions. | 一组代表职责或权限的名称，例如管理员或编辑者。 |
SSO lets one trusted identity provider authenticate a user for multiple connected applications.
Each application still validates the sign-in result, creates its own session, and decides what the user is allowed to do.
Core Flow:
User → Identity Provider → Signed Result → Application Session → Authorized Request