What are the benefits and challenges of using single sign-on (SSO) or federated identity?

SSO is particularly useful in business environments to help keep everything secure whilst helping the user experience. For instance imagine you are on a work computer and each day you routinely use different systems as part of your job. You don't want to have to login to every single system everyday, especially if you have already authenticated yourself securely to get onto the computer in the first place. With SSO it means you can login to your computer securely and then simply access all your other systems such as OneDrive, SharePoint, Outlook, 3rd party system or anything else you wish to integrate.

In a federated identity model, there are three main entities involved: the identity provider (IdP), the service provider (SP), and the user. The identity provider is responsible for verifying the user's identity and providing information about the user's attributes or claims. The service provider is the entity that provides access to the resources or services the user wants to use. The user is the person who wants to access the resources or services provided by the service provider. When a user wants to access a service from a service provider, the service provider redirects the user to the identity provider.

Simply said, SSO can be assessed for its comparative productivity benefits to businesses versus the time it takes for workers to continuously authenticate to myriad disparate systems while also considering human and nonhuman security factors that impact the volume and relative value of achieved electronic business tasks.

Federated is clunkier older method of integration of identity, SSO is modern and takes a few steps to step up, but gives insight down to the IP of machine being used. Both still have vulnerabilities to phishing campaigns and can be hashed using client sided salts.

SSO can be great, but there are a few potential pitfalls you should be aware of. 1. It may not always be possible to implement. For instance you may have to rely on the development teams of your systems and wait for them to add the functionality. 2. SSO tax. SSO is great and should be included as much as possible, but it may come at a cost. Here is a website that is dedicated to naming and shaming those companies that charge you for using SSO with their systems and sell it as a feature when it should be a standard security feature like MFA. Check this website https://sso.tax/

With the increasing sprawl of applications and services within any organization, and many of those now are SAAS so users are logging into things external to the org (don't want them entering credentials into external sites), the benefits of SSO fast outweigh the challenges. It's just that, like any critical service, it is essential to plan and manage it well. That can be done to minimize the challenges if it's given the attention it deserves.

Another challenge to this, is that there are people who are very vulnerable and do not know the ins and outs of technology and cannot relate to any of this. Some don't even know what an SSO is. As an IAM Security specialist, I worked with many senior citizens and help them to protect their systems because it is truly a doggy dog world if you are not technology savvy.

Federated requires multiple systems within multiple environments that are not integrated on the identity level. This allows for further vulnerability access points than SSO systems that gathers oath signatures per login defined on the global scale. Federated systems are scaled out across multiple stacks and environments and can work well in exceptions, but the standard should be an sso stack.