single sign-on (sso) is a property of access control of multiple related, but independent software systems. with this property a user logs in once and gains access to all systems without being prompted to log in again at each of them. this is typically accomplished using the lightweight directory access protocol (ldap) and stored ldap databases on servers. a simple version of single sign-on can be achieved using cookies but only if the sites are on the same domain. conversely, single sign-off is the property whereby a single action of signing out terminates access to multiple software systems. as different applications and resources support different authentication mechanisms, single sign-on must internally translate and store credentials for the different mechanisms, from the credential used for initial authentication. other shared authentication schemes not to be confused with sso include oauth, openid, openid connect and facebook connect, which require the user to enter their login credentials each time they access a different site or application. ==benefits== benefits of using single sign-on include: * reducing password fatigue from different user name and password combinations * reducing time spent re-entering passwords for the same identity * reducing it costs due to lower number of it help desk calls about passwords sso shares centralized authentication servers that all other applications and systems use for authentication purposes and combines this with techniques to ensure that users do not have to actively enter their credentials more than once. ==criticisms== the term reduced sign-on (rso) has been used by some to reflect the fact that single sign-on is impractical in addressing the need for different levels of secure access in the enterprise, and as such more than one authentication server may be necessary. as single sign-on provides access to many resources once the user is initially authenticated ("keys to the castle") it increases the negative impact in case the credentials are available to other persons and misused. therefore, single sign-on requires an increased focus on the protection of the user credent
Computer_access_control Federated_identity Password_authentication