Single Sign-on
Single sign-on means: you log in once and can then use multiple services without logging in again. A well-known example is the "Sign in with Google" button on other websites.
Normally, you need a separate password for every website and every program. Single sign-on turns this around. You log in only at one central point, for example your Google account or your school account. All other services then no longer ask for a password, but instead rely on this one login. The English name literally means “logging in once.” In German, it is also called Einmalanmeldung.
Fewer passwords, more control
People cannot remember thirty different passwords. That’s why many use the same one everywhere. If that one password is stolen, all accounts are suddenly open. Single sign-on solves the problem at its root: there is now only one password, and that one can be properly secured.
For companies, the advantage is mainly organizational. A new employee gets one access, and with it immediate access to email, calendar, accounting, and chat. If they leave, IT simply blocks this one access. Without single sign-on, old accounts often remain open in various programs that nobody thinks about anymore. Such “zombie accounts” are a classic security problem.
The downside is the flip side of the same idea. Whoever cracks the central login gets in everywhere. Experts call this a single point of failure, meaning a single spot whose failure paralyzes everything. That’s why single sign-on is almost always combined with a second proof, such as a code from an app on your phone.
What happens when you click “Sign in with Google”
Three parties are involved. First, you. Second, the service you want to use, for example a learning app. Third, the party that confirms your identity. This party is called the identity provider. Google, Microsoft, or your school’s server can be such providers.
The process is always similar. The learning app redirects you to the identity provider. There you enter your password, or you’re already logged in. The provider then issues a kind of digital confirmation, called a token. With this, it sends you back to the learning app. The app checks the token and lets you in.
One detail is important: the learning app never learns your password. It only sees the confirmation that the login succeeded, plus perhaps your name and email address. The token is also cryptographically signed, meaning it carries a mathematical seal that cannot be forged. Common frameworks for this process are called OAuth 2.0, OpenID Connect, and SAML. They differ in details but follow the same basic pattern.
From the school platform to the cloud corporation
In everyday life, you encounter single sign-on every time a website offers to log in with your Google, Apple, or Microsoft account. Schools and universities use it too: one login for the learning platform, WiFi, and library. In companies, often a hundred programs run through a single login service.
Providers of such services regularly appear in business news. Companies like Okta or Microsoft with its Entra ID service make money by managing logins for other companies. Security incidents at these providers are considered especially serious because they affect many customers at once.
A common misconception is confusing this with a password manager. A password manager stores many different passwords and enters them for you. With single sign-on, the other passwords don’t exist at all. Both make logging in easier, but they work in technically completely different ways.