0

I did some Googling on this and I can't seem to find a direct answer.

What is the difference between SSO and NT Authentication?

Is SSO a type of NT Authentication? Are they related at all?

I'm a developer just trying to expand my knowledge in other areas so if this is a crazy question you know why.

1

In general, yes, I'd say that NT Authentication is a type of SSO.

Windows authentication uses several protocols, but I'd say it is to some degree based on a SSO technology called Kerberos. It mainly manages a set of "tokens" which are digitally signed and timestamped, granting you access to several resources without the need of those resources to contact the central authentication server (int this case, usually aDomain controller).

Your NT authentication session typically starts when your login to Windows. From there it is used to manage your access tokens to several services. A service can however authenticate a user via other mechanisms:

Windows provides several backends for services to authenticate users, including plain Kerberos, NTLM (a browser oriented authentication method, which maybe you were referring to), and others, through its "security support provider interface", named SSPI.

2

SSO refers to a type of user experience, not a technology. SSO is short for "single sign on" and refers to any scenario where a user signs on only once and can access multiple applications that are otherwise independent.

Examples of SSO systems include

  • Any social login, e.g. when you use Facebook or Google to sign on to StackExchange.
  • Intranet applications (e.g. your HR web site) that authenticate employees based on NT authentication
  • Sites using OAuth, which was originally developed for Twitter
  • Sites using SAML, which is a somewhat older standard
  • Any .NET site participating in Federated Identity

NT authentication does not have to participate in an SSO. A standalone Windows computer may also authenticate you using NT authentication. But in many cases (e.g. within your corporate network), that same authentication mechanism can be utilized by other applications to recognize you, so that once you are signed on to your computer, you are automatically able to use those applications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.