Single sign-on (SSO) is an authentication setup in which one account, and the authenticators tied to it, give access to many applications without a separate login for each. It is usually built on a federation protocol, which passes identity and authentication information between trusted systems.

How it works

• The user signs in once at an identity provider (IdP), often with multi-factor authentication.
• When the user opens an application, the application redirects to the IdP, which returns a signed assertion or token confirming who the user is.
• The application trusts that assertion and creates its own session. Common standards for this exchange are SAML and OpenID Connect.
• Access can be granted or revoked centrally, which simplifies joiners, movers and leavers.

Why it matters for dark web monitoring

SSO concentrates risk. One set of SSO credentials, or one valid session token for the identity provider, can open every connected application. That makes SSO logins a priority target for phishing and for infostealer malware, and leaked SSO credentials or session cookies are among the most serious findings in a breach or credential report. Strong MFA at the identity provider, short session lifetimes and fast revocation help. Monitoring services watch for stolen corporate credentials and session data so that exposed SSO accounts can be reset before they are used.

Sources: NIST CSRC Glossary: single sign-on, NIST CSRC Glossary: federation