A company I am working for is advocating for single sign on for their Ecommerce site and an Online clinical testing platform that contain sensitive patient information.

My concern is the sensitive information on the patient testing site. Users of the ecommerce site does not always use the testing platform and vice versa, but there are some users who use both.

  • Single sign-on (SSO) provides authentication. It does not prevent access control (authorization). With SSO, a user without the rights to access the testing platform should not be able to access it.
    – A. Hersean
    Commented Oct 8, 2019 at 16:34

2 Answers 2


Unless the question is about a specific SSO provider, the answer is pretty simple. If SSO is implemented for your E-Commerce(EC) and Online Clinical Test (OCT), it only implies that both applications use the same identifying mechanism to identify a user. It does not imply that users would be given access to both sites by default. You should be having authorization controls which restricts users from accessing systems.


The main downside to SSO is that if the account in the Identity Provider is compromised (or the IdP itself is compromised), any Service Provider account that it grants access to is also compromised. Having multiple accounts with different strong passwords and different 2FA would mean that compromising one account doesn't compromise the other. Of course, that's not reality, in reality the users pick one password (hopefully strong) and use it for both accounts, and pick the same, most convenient 2FA option for both accounts. For just about every practical purpose, you are much better off focusing your users on securing one thing instead of many, asking them to choose one strong password and a good 2FA option like a mobile authenticator, or smart cards.

A company may also choose not to implement SSO because it is too costly to implement well internally (not just setting up the server, but securing it) for the perceived benefit and they do not trust any third party providers. However, in the OP case it sounds like management has identified the cost as acceptable for the benefit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .