What is Single Sign-On (SSO), and how does identity federation enable it?

• A. SSO allows a user to authenticate once to access multiple systems; federation delegates authentication to a trusted identity provider using standards like SAML, OAuth, or OpenID Connect.
• B. SSO requires multiple passwords; federation stores them in a local database.
• C. SSO and federation are identical; both bypass authentication.
• D. SSO uses one-time tokens; federation eliminates need for identity providers.

Answer: (A)

Single Sign-On means you prove your identity once to a central authority and then you can access multiple apps or services without re-entering credentials for each one. Identity federation makes that possible across different systems or organizations by linking trusted identity providers to service providers.

In practice, when you try to access a service, that service hands you to a trusted identity provider. The IdP authenticates you (checking your username/password, or an existing session) and then issues a signed token or assertion back to the service. The service provider validates that token using federation trust information (often exchanged as metadata and certificates) and, if valid, grants you access. Because the IdP handles authentication for all linked services, you don’t have to log in again for each new app.

Standards like SAML, OAuth, and OpenID Connect are the common ways these exchanges happen. They define how the authentication request travels, how the identity is asserted, and how the service can trust that assertion across different domains. The other descriptions miss that you still rely on an identity provider to authenticate, or suggest passwords are stored locally or bypassed, which isn’t what SSO and federation accomplish.