What is the difference between Federated Login and Single Sign On?

Question

What is the difference between Federated Login and Single Sign On authentication methods?

Answer 1

Single Sign-on (SSO) allows users to access multiple services with a single login.

The term is actually a little ambiguous. Sometimes it's used to mean that (1) the user only has to provide credentials a single time per session, and then gains access to multiple services without having to sign in again during that session. But sometimes it's used to mean (2) merely that the same credentials are used for multiple services; the user might have to login multiple times, but it's always the same credentials. So beware, all SSO's are not the same in that regard. Many people (me included) only consider the first case to be "true" SSO.

Federated Identity (FID) refers to where the user stores their credentials. Alternatively, FID can be viewed as a way to connect Identity Management systems together. In FID, a user's credentials are always stored with the "home" organization (the "identity provider"). When the user logs into a service, instead of providing credentials to the service provider, the service provider trusts the identity provider to validate the credentials. So the user never provides credentials directly to anybody but the identity provider.

FID and SSO are different, but are very often used together. Most FID systems provide some kind of SSO. And many SSO systems are implemented under-the-hood as FID. But they don't have to be done that way; FID and SSO can be completely separate too.

Answer 2

SSO allows a single authentication credential--user ID and password, smart card, one-time password token or a biometric device--to access multiple or different systems within a single organization. A federated identity management system provides single access to multiple systems across different enterprises.

source

Answer 3

Web SSO , can be defined as "you need to enter your credential once and is they are under same cookie provider , you dont need to re enter the username and password if they are also under same cookie provider" eg: Gmail-->google

Federated SSO can be defined as "you may be asked to use an application which is under different enterprise/network or say an other organisation , at this case we need to have Federation , where if you want to use the service of another firms web product eg service now then you will serve as the Identity provider[IDP] and they will be the service Provider[SP]"

Answer 4

Federation is a principal while SSO is just a use case. SSO may mean different things for different people but the common meaning is "using the same credential to login once per session which is used widely in many enterprises locally". Federation principle comes to solve the problem of many independent enterprises want to let their users to log in to use all their services, in another word logging across border. From this need comes what is called today Federated SSO which is one type of single sign on.

Answer 5

Single sign-on shouldn't need explaining! It's a quality of an IT system. You log in once, and for the duration of your session, authorization decisions can be made without you having to re-authenticate.

All of the subtlety comes when you want to enlarge the perimeter of resources covered by the single sign-on. On local machines and intranet domains the battles were won so long ago we've forgotten, but single sign-on had to be implemented in operating systems and domain controllers.

Today's battle is to provide single sign-on to every website in the world, and federated id is one of two architectural patterns used to solve this. The other, simpler and more prevalent, is delegated id. The difference is explained here If, as an authorization server, you're happy to accept an identity token knowing only that it's, for example, an OpenId token, not caring who generated it, then you're doing federated id.

Answer 6

Single Sign On (SSO): Single Sign On is a characteristic of an authentication mechanism that relates to the user’s identity being used to provide access across multiple service provider.

SSO allows a single authentication process (managed by a single Identity Provider or other authentication mechanism) to be used across multiple systems within a single organization or across multiple organizations.

Federated SSO: Federated Identity Management is a sub-discipline of IAM, but typically the same team(s) is involved in supporting it. Federation is a type of SSO where the actors span multiple organizations and security domains.

Federation is the trust relationship that exists between these organizations; it is concerned with where the user’s credentials are actually stored and how trusted third-parties can authenticate against those credentials without actually seeing them.

The federation relationship can be accomplished through one of several different protocols including (but, not limited to):

• SAML1.1

• SAML2

• WS-Federation

• OAuth2

• OpenID Connect

• WS-Trust

• Various proprietary protocols

You can also check out the list of single sign on implementations

Answer 7

FID researching in multi parties trusting in same Identity managment system, for example you can log in to Flicar by your Yahoo account; here Flicar depends on Yahoo and trust in it to authenetcate you.In FID it must be there a third party(identity provider) beside the user and the service provider.

SSO is researching in how to login to multi services by single sign in.for example if you login to your hotmail account you will be able to log in to SkyDrive service without need to log in again.

I dont have an example but I think you can either login by SSO to many services using FID or you can log in by SSO without using FID.