SSO and Federation
Single sign-on protocols.
SSO and Federation is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is SSO?
Single Sign-On (SSO) lets a user authenticate once and then access many applications without logging in again.
It improves user experience and centralizes security control.
The Identity Provider
SSO relies on an Identity Provider (IdP) that authenticates users and vouches for them.
Applications, called Service Providers (SP) or relying parties, trust the IdP instead of handling passwords themselves.
Why SSO Helps Security
SSO reduces risk by:
- Fewer passwords for users to reuse or leak.
- One place to enforce MFA and policy.
- Instant access revocation across all apps.
What Is Federation?
Federation extends trust across organizational boundaries.
It lets users from one domain (e.g. a partner company) access resources in another, using their home identity provider.
SAML
SAML (Security Assertion Markup Language) is an XML-based standard common in enterprise SSO.
The IdP sends a signed assertion to the SP confirming the user's identity and attributes.
OAuth 2.0
OAuth 2.0 is an authorization framework. It lets an app obtain a token to access resources on a user's behalf, without sharing the password.
Note: OAuth alone handles authorization, not identity.
OpenID Connect
OpenID Connect (OIDC) is an authentication layer built on OAuth 2.0.
It adds an ID token (a signed JWT) that proves the user's identity, making it the modern choice for web and mobile SSO.
The ID Token
An OIDC ID token is a JWT with claims about the user.
{
'iss': 'https://idp.example.com',
'sub': 'user-1234',
'aud': 'my-app',
'email': 'alice@example.com',
'exp': 1735689600
}How an SSO Login Flows
A typical OIDC login:
- App redirects the user to the IdP.
- User authenticates (with MFA if required).
- IdP redirects back with a token.
- App validates the token and starts a session.
Choosing a Protocol
General guidance:
- SAML: established enterprise apps.
- OIDC: modern web, mobile, and APIs.
- OAuth 2.0: delegated API access (authorization).
Federation Risks
Federation concentrates trust in the IdP. If the IdP is compromised, every connected app is at risk.
So the IdP must be hardened, monitored, and protected with strong, phishing-resistant MFA.
Quick Check
Which standard adds an authentication layer (an identity-proving ID token) on top of OAuth 2.0?
Recap
You learned about SSO and federation.
- An IdP authenticates users once for many apps.
- SAML suits enterprise; OIDC (on OAuth 2.0) suits modern apps.
- Federation extends trust across organizations but concentrates risk in the IdP.
Next, we cover the principle of least privilege.
Frequently asked questions
Is the “SSO and Federation” lesson free?
Yes — the full text of “SSO and Federation” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “SSO and Federation”?
Single sign-on protocols. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “SSO and Federation” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- IAM Fundamentals
- RBAC and ABAC
- SSO and Federation
- Least Privilege