You can accomplish SSO through different technologies. A more secure approach is an implementation where users donâ€t know the credential of each service they consume, but rather only the master. Since users donâ€t know each credential, thereâ€s no risk of circumventing your authentication center or sharing them across less secure platforms.
Organizations commonly deliver SSO through a trust model. A single identity provider (IdP) either holds the credentials or controls access to them. In this model, each service relies on the IdP to verify the identity of the accessing party. While this approach narrows the number of places that store the credential, users may or may not know the authentic credential to the service.
Any SSO design that synchronizes the credentials to each application or service is the least secure option and should rarely, if ever, be used. For security, organizations work to reduce the number of attack vectors, not increase them.
As a component of an advanced authentication environment, single sign-on can pair with multifactor authentication to strengthen the verification of a userâ€s identity while minimizing disruption. This approach helps organizations maximize usability and security, especially when paired with passive passwordless methods. While some passive authentication types may be weaker than others, you can use them with additional verification metrics for various digital resources. As part of risk service planning, security teams may organize their resources into sensitivity categories and assign corresponding authentication strengths.