{"id":248470,"date":"2026-11-05T00:00:16","date_gmt":"2026-11-05T00:00:16","guid":{"rendered":"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/"},"modified":"2026-11-05T00:00:19","modified_gmt":"2026-11-05T00:00:19","slug":"what-is-sso-federation","status":"publish","type":"post","link":"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/","title":{"rendered":"What Is SSO Federation? How Federated SSO Works"},"content":{"rendered":"<div class=\"336cb5b64765e27a1a6c1bb71b941f1a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-4830628043307652\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- above content -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-4830628043307652\"\r\n     data-ad-slot=\"5864845439\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<\/p>\n<p>SSO federation, also called federated SSO, is an arrangement in which one trusted identity provider (IdP) signs a user in, and other applications or organizations accept that sign-in instead of checking the password themselves. The user logs in once, and the IdP vouches for them everywhere that has agreed to trust it. NIST describes the core idea this way: <a href=\"https:\/\/pages.nist.gov\/800-63-4\/sp800-63c\/introduction\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">the relying party grants access based on an assertion from the IdP, without directly verifying the user\u2019s authenticators<\/a>.<\/p>\n<p>This guide explains the moving parts, how federation differs from ordinary single sign-on, how SAML, OpenID Connect and LDAP fit in, and what to protect once you rely on it.<\/p>\n<div data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"strip\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif\">\n<div style=\"border-radius:26px;padding:min(14px,3.2vw)\">\n<div style=\"background:#ffffff;border-radius:18px;overflow:hidden\">\n<div style=\"flex-wrap:wrap;align-items:center;gap:16px 22px;padding:20px 24px\">\n<div style=\"flex:1 1 260px;min-width:0\">\n<div style=\"margin:0 0 8px\"><span style=\"max-width:100%;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#F47F24;color:#ffffff\">Logmeonce<\/span><\/div>\n<div style=\"font-size:19px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0\">Connect SSO With Stronger Identity Security<\/div>\n<div style=\"font-size:14px;line-height:1.5;color:#64748b;margin-top:4px\">Explore identity security tools that include single sign-on and multi-factor authentication, alongside resources for protecting digital identities.<\/div>\n<\/div>\n<div style=\"flex:0 0 auto\"><a href=\"https:\/\/logmeonce.com\/resources\" style=\"align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#F47F24;color:#ffffff\">Explore LogMeOnce resources<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#TLDR\" >TL;DR<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#SSO_federation_in_plain_terms\" >SSO federation in plain terms<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Federation_can_stay_inside_one_company\" >Federation can stay inside one company<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#How_federated_SSO_works_step_by_step\" >How federated SSO works, step by step<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#What_the_trust_agreement_contains\" >What the trust agreement contains<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#SSO_vs_federation_what_is_the_difference\" >SSO vs. federation: what is the difference?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Federation_is_not_a_login_method\" >Federation is not a login method<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#SAML_OpenID_Connect_and_LDAP_how_they_relate\" >SAML, OpenID Connect and LDAP: how they relate<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#SAML_and_OpenID_Connect\" >SAML and OpenID Connect<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#LDAP\" >LDAP<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#SSO_and_user_federation\" >SSO and user federation<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#When_federated_SSO_makes_sense\" >When federated SSO makes sense<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Security_protect_the_identity_provider_first\" >Security: protect the identity provider first<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Perspective\" >Perspective<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Where_LogMeOnce_fits\" >Where LogMeOnce fits<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#A_short_glossary\" >A short glossary<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#What_is_federated_SSO_in_simple_words\" >What is federated SSO in simple words?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Is_SSO_the_same_as_federation\" >Is SSO the same as federation?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Do_federation_and_SAML_mean_the_same_thing\" >Do federation and SAML mean the same thing?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Is_federated_SSO_secure\" >Is federated SSO secure?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Does_federation_replace_a_password_manager\" >Does federation replace a password manager?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/logmeonce.com\/resources\/what-is-sso-federation\/#Sources\" >Sources<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"tldr\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Federation is a trust agreement between an identity provider and the apps (relying parties or service providers) that accept its login assertions.<\/li>\n<li>Single sign-on is the experience: log in once, reach many apps. Federation is one way to deliver that experience across organizational boundaries.<\/li>\n<li>Federation is an architecture, not a login method. The IdP can use passwords, one-time codes, biometrics or passkeys.<\/li>\n<li>SAML and OpenID Connect are the two main protocols; LDAP is a directory protocol, a different kind of thing.<\/li>\n<li>The IdP becomes the most valuable target, so protect it with strong, phishing-resistant authentication and release as few user attributes as possible.<\/li>\n<\/ul>\n<h2 id=\"sso-federation-in-plain-terms\"><span class=\"ez-toc-section\" id=\"SSO_federation_in_plain_terms\"><\/span>SSO federation in plain terms<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Picture a conference badge. You prove who you are once at the registration desk. After that, every room accepts the badge, and the room staff never ask for your passport. The desk is the identity provider. The rooms are the service providers. The agreement that the rooms honor the desk\u2019s badges is the federation.<\/p>\n<p>In technical vocabulary, NIST calls the app the relying party (RP) and the login authority the identity provider. After an authentication event, <a href=\"https:\/\/pages.nist.gov\/800-63-4\/sp800-63c\/introduction\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">the IdP sends an assertion, and the RP verifies it, creates a session and grants access<\/a>. The same NIST text notes that federation can let a person obtain services from several RPs without a separate authenticator for each, and that this is sometimes known as SSO.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1793732499602_Steps-in-a-federated-SSO-login-flow.jpeg\" alt=\"Steps in a federated SSO login flow\" title=\"\"><\/p>\n<p>That last phrase explains why searchers use \u201cSSO federation\u201d and \u201cfederated SSO\u201d interchangeably. They point at the same practical result: one login, many destinations, with trust established between parties ahead of time.<\/p>\n<h3 id=\"federation-can-stay-inside-one-company\"><span class=\"ez-toc-section\" id=\"Federation_can_stay_inside_one_company\"><\/span>Federation can stay inside one company<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Federation is often pictured as a partnership between two businesses, but it does not have to be. The FIDO Alliance notes that <a href=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/Enterprise_Adoption_Best_Practices_Federation_FIDO_Alliance.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">federation can operate within one organization as well as across organizations<\/a>, though its major value is letting identities be trusted across administrative or security boundaries. A company with several business units, each running its own systems, can federate internally. A university can federate with a research partner. A retailer can federate with a supplier portal.<\/p>\n<h2 id=\"how-federated-sso-works-step-by-step\"><span class=\"ez-toc-section\" id=\"How_federated_SSO_works_step_by_step\"><\/span>How federated SSO works, step by step<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The flow is the same in most deployments, whatever the protocol. MDN describes it as <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/Security\/Authentication\/Federated_identity\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">a redirect to the IdP, authentication there, and a token returned to the site, which checks it and signs the user in<\/a>.<\/p>\n<ol>\n<li><strong>You open an app.<\/strong> You go to a service provider, for example a partner\u2019s project portal.<\/li>\n<li><strong>The app redirects you.<\/strong> It does not show a password box of its own. It sends you to the identity provider you are set up with.<\/li>\n<li><strong>You authenticate at the IdP.<\/strong> This is where the password, code, biometric or passkey is checked. The IdP holds and manages the credentials.<\/li>\n<li><strong>The IdP issues an assertion or token.<\/strong> It is a signed statement that says who you are and, often, a few attributes such as your name, email or role.<\/li>\n<li><strong>The app validates it.<\/strong> The service provider checks the signature and the validity of the statement, creates its own session and lets you in.<\/li>\n<li><strong>Other apps reuse the same event.<\/strong> When you open a second federated app, the IdP already knows you are signed in and issues another assertion without prompting you again, within the limits of its session rules.<\/li>\n<\/ol>\n<p>The key point is in step 3. The service provider never sees your password. It trusts the IdP\u2019s word about your identity, which is why the setup works across companies that would never share a user database.<\/p>\n<h3 id=\"what-the-trust-agreement-contains\"><span class=\"ez-toc-section\" id=\"What_the_trust_agreement_contains\"><\/span>What the trust agreement contains<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>IDPro describes federation as providers agreeing to <a href=\"https:\/\/bok.idpro.org\/article\/id\/62\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">operate using standard protocols and trust agreements<\/a>, and notes that connecting an IdP and a service provider can involve exchanging metadata. In practice, that exchange covers things such as the addresses where login requests are sent, the certificates used to verify signatures, and which user attributes will be shared.<\/p>\n<p>The FIDO Alliance points out an advantage here: <a href=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/Enterprise_Adoption_Best_Practices_Federation_FIDO_Alliance.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">federation abstracts each organization\u2019s internal identity infrastructure<\/a> from the other party. Your partner does not need to know how your directory is built, and you do not need to know theirs. That makes integrations less brittle when either side changes its internals.<\/p>\n<h2 id=\"sso-vs-federation-what-is-the-difference\"><span class=\"ez-toc-section\" id=\"SSO_vs_federation_what_is_the_difference\"><\/span>SSO vs. federation: what is the difference?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The two terms overlap, and that is the source of most confusion. A useful way to separate them:<\/p>\n<ul>\n<li><strong>SSO<\/strong> describes what the user experiences: one sign-in, access to several applications.<\/li>\n<li><strong>Federation<\/strong> describes how trust is arranged so that sign-in can travel between separate systems or organizations.<\/li>\n<\/ul>\n<p>SSO can exist without federation. A company might put all of its own apps behind one login using a shared directory, with no external parties involved. Federation is the mechanism you add when the apps, domains or organizations do not share one identity system. When people say \u201cfederated SSO,\u201d they mean SSO delivered through a federation.<\/p>\n<table>\n<thead>\n<tr>\n<th><\/th>\n<th>Basic SSO inside one organization<\/th>\n<th>Federated SSO<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Who trusts whom<\/td>\n<td>Apps trust one internal login system<\/td>\n<td>Apps trust an IdP through an agreement, possibly in another organization<\/td>\n<\/tr>\n<tr>\n<td>Typical scope<\/td>\n<td>One company\u2019s own apps<\/td>\n<td>Several domains, partners, cloud services or business units<\/td>\n<\/tr>\n<tr>\n<td>Who stores the credentials<\/td>\n<td>The organization\u2019s own directory<\/td>\n<td>The IdP only; relying apps never see them<\/td>\n<\/tr>\n<tr>\n<td>Typical protocols<\/td>\n<td>Varies by product<\/td>\n<td>SAML or OpenID Connect<\/td>\n<\/tr>\n<tr>\n<td>Main benefit<\/td>\n<td>Fewer passwords for staff<\/td>\n<td>Fewer passwords plus trust across boundaries<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The table is a simplification, because real products blend the two. The practical test is simple: if an app accepts a login that was performed somewhere else and vouched for by assertion, you are looking at federation.<\/p>\n<h3 id=\"federation-is-not-a-login-method\"><span class=\"ez-toc-section\" id=\"Federation_is_not_a_login_method\"><\/span>Federation is not a login method<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>One more distinction trips people up. Federated SSO does not say how you prove yourself. MDN separates the <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/Security\/Authentication\/Federated_identity\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">federated identity architecture from the authentication methods used within it<\/a>. The IdP might ask for a password, a one-time code, a fingerprint or a passkey. Federation only decides where that check happens and how the result is passed along.<\/p>\n<p>This matters for security: a federation built on weak sign-in is a weak federation with a very wide reach. A federation built on strong, passwordless sign-in extends that strength to every connected app.<\/p>\n<h2 id=\"saml-openid-connect-and-ldap-how-they-relate\"><span class=\"ez-toc-section\" id=\"SAML_OpenID_Connect_and_LDAP_how_they_relate\"><\/span>SAML, OpenID Connect and LDAP: how they relate<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Two of the \u201cpeople also ask\u201d questions on this topic compare federation with protocols. They are not alternatives to federation; they are pieces of it, or neighbors to it.<\/p>\n<h3 id=\"saml-and-openid-connect\"><span class=\"ez-toc-section\" id=\"SAML_and_OpenID_Connect\"><\/span>SAML and OpenID Connect<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>SAML and OpenID Connect (OIDC) are the two principal protocols used to carry federated SSO. The FIDO Alliance describes them as <a href=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/Enterprise_Adoption_Best_Practices_Federation_FIDO_Alliance.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">standards that let a user authenticate in one domain and use that authentication in another<\/a>. So the right way to phrase the relationship is: federation is the concept and the trust arrangement, and SAML or OIDC is the language the IdP and the app use to carry out the assertion.<\/p>\n<p>As a rule of thumb, SAML has long been common in workforce and enterprise software, while OIDC is widespread in web and mobile apps. Many organizations run both. Which one an app supports is usually listed in its admin documentation.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1793732538385_SAML-and-OpenID-Connect.jpeg\" alt=\"SAML and OpenID Connect\" title=\"\"><\/p>\n<h3 id=\"ldap\"><span class=\"ez-toc-section\" id=\"LDAP\"><\/span>LDAP<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>LDAP is a different kind of tool. It is <a href=\"https:\/\/support.jivesoftware.com\/article\/9683-ldap-integration-faq\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">a protocol for accessing and maintaining directory information<\/a>, the lists of users, groups and attributes an organization keeps. An application can check logins against an LDAP directory, which centralizes accounts, but the application still handles the password exchange itself. Federation instead moves the authentication to an IdP and passes back a signed assertion.<\/p>\n<p>In many companies the two coexist: the directory holds the people, and the IdP uses that directory to authenticate users before issuing assertions to federated apps.<\/p>\n<h3 id=\"sso-and-user-federation\"><span class=\"ez-toc-section\" id=\"SSO_and_user_federation\"><\/span>SSO and user federation<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Some software products use \u201cuser federation\u201d to mean something narrower: linking or syncing accounts from an external directory so the product can recognize those users. That is a way of bringing identities in, whereas federated SSO is a way of trusting a login performed elsewhere. The two can be combined, but they are not the same thing, so read the product\u2019s documentation to see which meaning it uses.<\/p>\n<h2 id=\"when-federated-sso-makes-sense\"><span class=\"ez-toc-section\" id=\"When_federated_SSO_makes_sense\"><\/span>When federated SSO makes sense<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Federation pays off where identities must cross a boundary:<\/p>\n<ul>\n<li><strong>Partners and suppliers.<\/strong> External staff reach your portal with the login their own employer manages, so you do not create and retire accounts for them.<\/li>\n<li><strong>Mergers and multiple business units.<\/strong> Each unit keeps its directory while users still reach shared apps.<\/li>\n<li><strong>Cloud apps.<\/strong> Staff sign in to many software-as-a-service tools with one corporate identity.<\/li>\n<li><strong>Managed service providers.<\/strong> Teams that support several client environments need access that is controlled and reversible.<\/li>\n<\/ul>\n<p>A single office with a handful of apps may not need it. A shared password manager with strong authentication can cover that case with less setup. As the number of apps, partners and domains grows, federation starts to earn its keep.<\/p>\n<h2 id=\"security-protect-the-identity-provider-first\"><span class=\"ez-toc-section\" id=\"Security_protect_the_identity_provider_first\"><\/span>Security: protect the identity provider first<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Federation reduces the number of places where passwords live, but it concentrates trust in one place. NIST\u2019s guidance for identity providers is direct: <a href=\"https:\/\/pages.nist.gov\/800-63-3-Implementation-Resources\/63C\/IdP\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">protect the IdP and its private signing keys, use phishing-resistant technologies, protect subscriber attributes and minimize disclosures<\/a>. It also warns that a compromised IdP signing key could allow someone to create arbitrary assertions and impersonate users at any relying party.<\/p>\n<p>Turn that into a practical checklist:<\/p>\n<ol>\n<li><strong>Require strong authentication at the IdP.<\/strong> Passwordless and phishing-resistant methods close the most common attack paths.<\/li>\n<li><strong>Guard signing keys and certificates.<\/strong> Limit who can reach them, and know how you would replace them quickly.<\/li>\n<li><strong>Share the minimum.<\/strong> NIST advises IdPs to <a href=\"https:\/\/pages.nist.gov\/800-63-3-Implementation-Resources\/63C\/IdP\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">release only the attributes a login needs<\/a>. If a service needs a role, do not also send a phone number.<\/li>\n<li><strong>Review connected apps.<\/strong> Remove integrations nobody uses, since each one is a trust relationship.<\/li>\n<li><strong>Plan for recovery.<\/strong> Decide how users regain access if the IdP is unavailable or an account is locked.<\/li>\n<\/ol>\n<h2 id=\"perspective\"><span class=\"ez-toc-section\" id=\"Perspective\"><\/span>Perspective<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<blockquote>\n<p>Most teams we talk to do not want a lecture on protocols. They want fewer passwords, fewer lockouts and fewer accounts to clean up when someone leaves.<\/p>\n<p>We see federation as one layer in a wider identity plan. The login at the center should be as strong as you can make it, which is why we put so much weight on passwordless multi-factor authentication. Take away the password, and the assertion your apps trust rests on something much harder to phish.<\/p>\n<p>Federation does not replace everyday credential hygiene either. People still hold logins for apps that sit outside any federation, and those logins need a password manager that generates and stores unique passwords. Our approach pairs single sign-on and passwordless MFA with password management and dark web monitoring, so one identity plan covers both the federated apps and the rest.<\/p>\n<p>Start small: pick your most-used apps, put strong sign-in in front of them, and expand from there.<\/p>\n<p><em>Mike<\/em><\/p>\n<\/blockquote>\n<h2 id=\"where-logmeonce-fits\"><span class=\"ez-toc-section\" id=\"Where_LogMeOnce_fits\"><\/span>Where LogMeOnce fits<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>If you are building toward one strong login across your apps, our <a href=\"https:\/\/logmeonce.com\/passwordless-mfa\" target=\"_blank\" rel=\"noopener\">passwordless MFA<\/a> removes the password from the sign-in step, and our <a href=\"https:\/\/logmeonce.com\/blog\/identity-management\/single-sign-online-security-neednt-complex\" target=\"_blank\" rel=\"noopener\">single sign-on overview<\/a> explains the everyday benefits for users.<\/p>\n<p>For teams, our <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">business plans<\/a> list Teams at $4.00 per month per user and Business at $7.99 per month per user, with Enterprise available for larger organizations. Individuals can start on the Premium plan at $0.00 per month and compare personal options on the <a href=\"https:\/\/logmeonce.com\/pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">pricing and comparison page<\/a>.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/csuxjmfbwmkxiegfpljm.supabase.co\/storage\/v1\/object\/public\/blog-images\/organization-6456\/1760417791460_logmeonce.jpg\" alt=\"Logmeonce\" title=\"\"><\/p>\n<p>Browse the full range, from the password manager to identity theft protection and cloud storage encryption, on our <a href=\"https:\/\/logmeonce.com\/resources\" target=\"_blank\" rel=\"noopener\">resources page<\/a>.<\/p>\n<h2 id=\"a-short-glossary\"><span class=\"ez-toc-section\" id=\"A_short_glossary\"><\/span>A short glossary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>Identity provider (IdP):<\/strong> the system that authenticates users and issues assertions.<\/li>\n<li><strong>Service provider (SP) or relying party (RP):<\/strong> the application that accepts the assertion and grants access.<\/li>\n<li><strong>Assertion or token:<\/strong> the signed statement from the IdP about who the user is.<\/li>\n<li><strong>Federation:<\/strong> the trust agreement and technical setup that lets an SP accept an IdP\u2019s assertions.<\/li>\n<li><strong>Metadata:<\/strong> the configuration details, such as endpoints and certificates, that the two sides exchange.<\/li>\n<li><strong>Attribute:<\/strong> a piece of user information, such as an email or role, passed along with the assertion.<\/li>\n<\/ul>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"what-is-federated-sso-in-simple-words\"><span class=\"ez-toc-section\" id=\"What_is_federated_SSO_in_simple_words\"><\/span>What is federated SSO in simple words?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Federated SSO lets you sign in once with an identity provider and then use other apps or organizations that trust it. Those apps never see your password. They receive a signed confirmation of who you are and let you in.<\/p>\n<h3 id=\"is-sso-the-same-as-federation\"><span class=\"ez-toc-section\" id=\"Is_SSO_the_same_as_federation\"><\/span>Is SSO the same as federation?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Not quite. SSO is the one-login experience, and federation is the trust setup that lets that login work across separate systems or organizations. Federated SSO combines both, while simple SSO can also run inside one company without federation.<\/p>\n<h3 id=\"do-federation-and-saml-mean-the-same-thing\"><span class=\"ez-toc-section\" id=\"Do_federation_and_SAML_mean_the_same_thing\"><\/span>Do federation and SAML mean the same thing?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No. Federation is the overall arrangement of trust. SAML is one of the two main protocols, along with OpenID Connect, used to carry the assertion from the identity provider to the app.<\/p>\n<h3 id=\"is-federated-sso-secure\"><span class=\"ez-toc-section\" id=\"Is_federated_SSO_secure\"><\/span>Is federated SSO secure?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It can be very secure when the identity provider is well protected. Use phishing-resistant sign-in, safeguard signing keys and share only the attributes each app needs. Because one IdP serves many apps, its security matters more, not less.<\/p>\n<h3 id=\"does-federation-replace-a-password-manager\"><span class=\"ez-toc-section\" id=\"Does_federation_replace_a_password_manager\"><\/span>Does federation replace a password manager?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No. Federation covers the apps connected to your identity provider. Accounts outside it still need unique, strong passwords, which a password manager can generate and store.<\/p>\n<h2 id=\"sources\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/pages.nist.gov\/800-63-4\/sp800-63c\/introduction\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">NIST SP 800-63C: Federation and Assertions, Introduction<\/a><\/li>\n<li><a href=\"https:\/\/pages.nist.gov\/800-63-3-Implementation-Resources\/63C\/IdP\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">NIST Guide for Identity Providers (SP 800-63-3 implementation resources)<\/a><\/li>\n<li><a href=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/Enterprise_Adoption_Best_Practices_Federation_FIDO_Alliance.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FIDO Alliance: Enterprise Adoption Best Practices for Federation<\/a><\/li>\n<li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/Security\/Authentication\/Federated_identity\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">MDN: Federated identity<\/a><\/li>\n<li><a href=\"https:\/\/bok.idpro.org\/article\/id\/62\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">IDPro Body of Knowledge: Federation Simplified<\/a><\/li>\n<li><a href=\"https:\/\/support.jivesoftware.com\/article\/9683-ldap-integration-faq\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Jive Support: LDAP Integration FAQ<\/a><\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>SSO federation lets one trusted identity provider sign you in across separate organizations and apps. See how it works, how it differs from plain SSO, and its risks.<\/p>\n","protected":false},"author":0,"featured_media":248472,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-248470","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-logmeonce"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248470","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/comments?post=248470"}],"version-history":[{"count":1,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248470\/revisions"}],"predecessor-version":[{"id":248471,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248470\/revisions\/248471"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media\/248472"}],"wp:attachment":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media?parent=248470"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/categories?post=248470"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/tags?post=248470"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}