How does Single Sign-On (SSO) work? | Hacker News Reader

How does Single Sign-On (SSO) work?

newsletter.techworld-with-milan.com

50 pointsthunderbong14 comments

A nice overview of SSO, which is also known as federation.

Leaves out some of the more complicated aspects of SSO, such as:

* Logout (surprisingly complicated, see this video for more: https://m.youtube.com/watch?v=96m7DDQBW0U )

* Linking accounts (if you let someone login with Google, then also let them login with email and they use the same Gmail address, is it one account or two?)

* Verifying account ownership (more important for if anyone can register under any email address)

* Setting up the SSO integration (how does Google know how to trust Trello?)

Actually logout is not complicated. But openidconnect allows single-logout , which most of the time, you do not even need.

Logout across multiple systems is pretty complicated. You can do it with browser redirects, at least for now[0], but that relies on every system succeeding.

What am I missing?

0: the fedcm work is going to impact redirects. https://github.com/fedidcg/FedCM/blob/main/explainer.md

The thing is, most of the time you don’t want single logout. You want to logout of the specific application, not from the idp and all rp‘s. Think about it, which user want to logout from your app and entra id and all the rp‘s? Probably only a few.

Ah. In that case, I agree, it is relatively simple.

It really depends what you are doing. If you control your own idp and you have multiple rp‘s you probably need it tough, but in this case a lot of things are hard, no matter if you use openid connect or nothing.

Btw. even if you target entra id or other idp‘s it’s always a good idea to also have a way to trigger the single logout, some people might need it, so it is good to have it behind an Option. Also you should at least implement the backchannel logout. But as said none is really a requirement and often you just use an upfront idp as a second way to login and maintain your own user data in this case single logout is just an addon not a necessity.

SSO protocols work great until you try to implement then 100% to spec. Then you realize how many vendors do weird shit with their SPs.

Small plug for my startup (hope that's ok!!)

This is what WorkOS helps solve for developers. It's like Stripe for SAML (and other enterprise features)

https://workos.com/single-sign-on

Happy to chat with anyone who's interested! mg@workos.com

Like what Michael said, there are a number of companies willing to act as an adapter for your SSO needs. My employer, FusionAuth, is another.

Agreed that every SP is slightly different. There's a reason the SAML spec is 800+ pages, it covers a lot of variations. Since it has not been substantially updated since, there are some legacy choices (hello XML).

We also maintain an open source java SAML library: https://github.com/FusionAuth/fusionauth-samlv2

SSO is simple on the surface and complex once you peel it back!

The author's posts are well written. I browsed through several related articles because I'm doing some work in the authz/authn space right now and this helps to get my head back into it a bit. None of the articles seem to go super deep, but that's ok. I'm also in the middle of reading OpenID Connect In Action. It seems ok, but rather dry so far. Maybe the subject material is just inherently a bit tedious and boring to me personally. Does anyone have any good posts or books they would recommend for getting a better grasp on some of the authentication protocols?

I always recommend these books/resources:

* OAuth2 in action: https://www.manning.com/books/oauth-2-in-action which is great because it build an OAuth2 server in an accessible language, JavaScript

* Solving identity in modern applications: https://link.springer.com/book/10.1007/978-1-4842-8261-8 which is dry but a great book about the modern identity lifecycle and an overview of the relevant protocols

* I co-authored this ebook about the different modalities of OAuth: https://leanpub.com/themodernguidetooauth if you email me (email in profile), happy to get you a PDF for free

* Security Engineering is great for some of the fundamentals, about hashing, for instance: https://www.cl.cam.ac.uk/~rja14/book.html (haven't finished it yet, though)

Finally joining the OAuth mailing list is a great way to keep on top of the evolution of the protocols: https://www.ietf.org/mailman/listinfo/oauth

Thank you for these. Always enjoy book recommendations .

newbie question: in https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_pr... What is the point of step 8/9? Couldn't a wrong password already be rejected in step 5/6?

This isn’t about passwords. The token from the identity server (Google in this case), describes the user, including their identity - which you may use as a link to the user data. If I were to forge an token, I could impersonate the user. For this reason, you need to verify the token with the identity server.

Reply on news.ycombinator.com