What is single sign-on?¶
id: "AI-022" title: "What is single sign-on?" series: "Accounts and Identity" content_type: "video-script" status: "draft" owner: "IF Digital"
What is single sign-on?¶
Script¶
You open one service and are allowed into another without entering a separate password.
That may be single sign-on.
Single sign-on allows one trusted identity provider to authenticate the user for several connected services.
A workplace account may provide access to email, cloud storage and internal systems.
A user may choose “Sign in with Google”, “Sign in with Apple” or another linked identity.
The second service relies on the first service's authentication decision.
That can simplify access for users.
It can also complicate an investigation.
The account being used may not have its own password.
Access may depend on the security of the linked identity provider.
A compromise of the main account may therefore expose several connected services.
When examining login evidence, ask which service actually authenticated the user.
Was the account accessed directly?
Was access granted through Google, Microsoft, Apple, Facebook or an organisational identity system?
Which account held the primary credentials?
Which provider created the session?
Also look at the permissions granted.
Single sign-on may share basic identity information, such as a name and email address.
It may also allow access to additional data, depending on the service and the user's consent.
Be precise about the records.
A service may show that access occurred through a particular identity provider.
That does not automatically prove that the named account holder personally completed the login.
The identity-provider account could have been shared, compromised or already active on the device.
Single sign-on can also explain why no separate password is found for the second service.
The user may never have created one.
For investigators, the practical point is simple.
Do not treat every online account as an isolated system.
Establish whether access depended on another account.
The linked identity may hold the stronger authentication records, recovery history and security events.