Single Sign-On or Identity Federation – What is The Difference?
Weak or stolen passwords can be costly for companies and different types of single sign-on solutions have started gaining widespread adoption. It’s our experience that many people confuse traditional single sign-on and identity federation, and with good reason: The two technologies provide a very similar experience to end users. With each, the user logs in once and can then access multiple applications without having to log in again. But, in fact, single sign-on is only one of many aspects of identity federation.
Single Sign-On
Single sign-on is an umbrella term that refers to the ability of a user to log in to or access multiple systems within a single domain by providing only one set of login credentials only one time, which are then used throughout the user’s entire session. These credentials can be a username and password, an electronic identity, a one-time password, or even biometric identification data.
Other than through identity federation, there are basically two different ways to achieve single sign-on:
1. Use Microsoft Active Directory to authenticate users logging in to web applications (Integrated Windows Authentication). Authentication is handled by the web browser, which lets a user who is logged in to the network with a set of Active Directory/Windows credentials access other applications on the network automatically after identifying that the user was created in Active Directory.
2. Use an enterprise single sign-on solution. Once a user is logged in to the organization’s domain, the enterprise single sign-on solution handles all logins to other applications for the user. In other words, a login does take place every time a user starts an application, but it takes place behind the scenes: The user doesn’t have to enter any login credentials and instead experiences single sign-on.
Both single sign-on solutions enhance security by requiring users to remember only one set of credentials for authentication – which avoids the problem of users relying on insecure methods to remember multiple sets of credentials, such as writing passwords down, reusing the same password for multiple applications, creating weak passwords that are easy to remember, etc. These single sign-on solutions also help improve efficiency and reduce help desk costs as forgotten or expired passwords normally generate up to 40% of all calls to the help desk.
However, with both solutions, there are also some severe limitations:
-
Integrated Windows Authentication doesn’t work across organizational borders, when your users need to access cloud applications or when external users, such as partners, customers, or suppliers, need access to your applications. It also gives you no choice as to which type of authentication you want to use, for instance if you want to use multi-factor authentication for stronger authentication.
-
With an enterprise single sign-on solution, there is an issue of dealing with the different applications having different password policies. Some applications need the password changed every month, others every 42 days, etc. It is possible to have the enterprise single sign-on software change the passwords, but this gets complicated when you want to go away from the system and use another product.
-
Also with enterprise single sign-on, the users’ login credentials are stored in each individual application; therefore, it is still possible to log directly in to an application. When an employee leaves your organization, this could cause a security problem.
Identity federation
A third option for delivering single sign-on is through identity federation, but identity federation is much more than just single sign-on. Identity federation refers to linking and using the digital identities and access rights a user has across several domains. With identity federation, organizations form trusted partnerships with one or more partner organizations (similar to joining a federation of states) and all the organizations within the federation agree on a common method to share identities and enable authentication and authorization between them.
With identity federation, a user’s identity information is always stored in the user’s own organization in an infrastructure component called an “identity provider” and so the individual application does not need to obtain and store user information in order to authenticate users.
When a user logs in to an application or service, instead of providing login credentials to the application, the applications trusts the identity provider to validate the credentials. So the user never provides login credentials directly to anybody but the identity provider.
This means that the end users are able to log in one time within their own organization and then access multiple systems across different organizations and locations within the federation without logging in again.
In addition to providing single sign-on across organizations and to cloud applications, the right identity federation solution can deliver a long list of other business benefits, including:
-
Simple and cost-effective user management. Users are created, managed, and deleted centrally across all on-premises and cloud applications.
-
Increased security. Users only have one identity and are deleted in all systems at once.
-
Improved collaboration and engagement with partners and customers. With identity federation, it is possible to provide external users direct access to (parts of) your applications.
-
Cost savings. You avoid having to create Active Directory accounts for all users who need access to your applications.
-
Greater user experience. End users are allowed to access your applications with any authentication method, including social logins and electronic identities.
-
Combined ease of use for end users with strong password security. Different login requirements can be set for different applications depending on the level of security needed.
