Tech_Interview_Prep

SSO & Federation Protocols (SAML, OIDC)

How a user authenticates once with an identity provider and gets trusted access across many applications.

OverviewQ&AMCQ

What it is

Single sign-on (SSO) lets a user authenticate once with a central identity provider and be trusted by many separate applications — federation protocols (SAML, OIDC) are the standards that make this trust portable and interoperable.

Key points

  • SAML: XML-based, older but still widely used in enterprise contexts — an identity provider issues a signed assertion that a service provider trusts.
  • OIDC (OpenID Connect): built on top of OAuth 2.0, JSON/REST-based, and the modern default for new implementations — adds an identity layer (an ID token) on top of OAuth's authorization framework.
  • Identity provider vs. service provider: the IdP authenticates the user and issues the trusted assertion/token; the service provider (the application) trusts that assertion instead of managing its own username/password store.
  • Federation is what makes centralized deprovisioning possible — disabling a user at the IdP immediately cuts off access to every federated application, which is a major security win over each app managing its own separate credentials.