Single sign-on

Instead of an account on every service, a person authenticates once to a trusted identity provider (IdP), which then vouches for them to each service (a relying party or service provider) with a short-lived token or ticket. Kerberos is SSO inside one realm: one kinit yields tickets for every service. On the web the same idea is SAML and OpenID Connect (built on OAuth): the service redirects the browser to the IdP, the person logs in there, and comes back with a signed assertion (SAML, XML) or id_token (OIDC, a JWT) the service checks. The password is only ever seen by the IdP; the service trusts the token because its signature verifies against the IdP's public signing key (OIDC publishes these at a JWKS endpoint, SAML embeds an X.509 certificate in its metadata). The service also checks the token was issued by the expected IdP (iss), minted for this service (aud) and not expired (exp). So two quiet faults break SSO: trusting the wrong or a stale signing key (every token looks forged), and a skewed clock (valid tokens look expired, or expired ones look valid). The wins are one strong login (with MFA in one place) and one place to disable an account; the risk is that the IdP becomes a single, high-value target.

See it on real machines