Why customer experience is impossible without Single Sign-on

Connecting UUIDs for different applications based on SAML uses certificates to verify the authentication. This makes Single Sign-on more secure than just using passwords. It is important not to confuse Single Sign-on with password filling. With password filling, a central user database stores your usernames and passwords for your different applications and automatically fills them in when you access the application. This gives the impression that you are using SSO but, in fact, you are not because, with every authentication, the username and password are still sent over the internet to your application. The fact that username and password are filled in automatically, does not make it safer, on the contrary. If the user doesn’t use an automated password generator, your users’ credentials may be available on the dark web, exposed to other applications. And even if a unique password is generated, these credentials are used for every session, and can be stolen through keyboard loggers or phishing techniques.   Applications like iCloud Keychain may also give you the impression of SSO, protected by biometrics. However: you are only using fingerprint or face recognition to unlock the Keychain, not to authenticate to an application. You may still be sending usernames and passwords over an insecure channel and exposing yourself to hackers or Man-in-the-Middle attacks. This is not the case when you work with SSO based on certificates.

Using SSO is also safer for an organization that works with outside employees, for instance employees that belong to a project partner or a contractor. These third-party employees gain access to applications using the credentials of their own company and a technique called federated authentication. This makes onboarding these external employees easy and safe: when they leave their company, their credentials will no longer be valid and it will be impossible to access other organizations’ systems using those credentials.