SSO and Federation
Single sign-on (SSO) lets a user reuse authentication across applications rather than enter credentials separately in each one. Federation establishes trust between an identity provider (IdP) and applications that accept its authentication information. The application redirects to the IdP, which can reuse an existing sign-in or authenticate the user. Source: IAM Ecosystem Explained (09:08-10:27).
Protocol Versus Token Format
These terms occupy different layers. The video’s comparison separates authentication, delegated access, and token representation. Source: IAM Ecosystem Explained (10:27-12:34).
| Term | Responsibility | Important Boundary |
|---|---|---|
| SAML | Federated authentication using assertions; common in enterprise SSO | Not account provisioning |
| OpenID Connect (OIDC) | Identity layer built on OAuth 2.0; provides an ID token | ID tokens and API access tokens have different purposes |
| OAuth 2.0 | Limited application access, illustrated by delegated sales-data access | Not interchangeable with a user-authentication protocol |
| JSON Web Token (JWT) | Format for claims; used for OIDC ID tokens | Not a login protocol; access tokens can use other formats |
In the video’s OIDC example, an application receives an authorization code and exchanges it for tokens. In its OAuth example, a restaurant owner grants an accounting application access to sales data without sharing a password. These explain different purposes, not a complete implementation guide or every available flow. Source: IAM Ecosystem Explained (09:49-10:27; 11:27-12:34).
Sessions Are Another Boundary
Application sessions support continued use after login. Depending on the design, access and refresh tokens also support continued access. Stopping future IdP sign-ins does not necessarily end an existing application session or disable a direct local login. Offboarding must address each relevant mechanism and verify the result; token revocation is qualified by what the system supports. Source: IAM Ecosystem Explained (12:34-13:26; 15:40-16:36; 27:09-27:53).
SCIM provisioning maintains accounts rather than authenticating users. Multi-Factor Authentication strengthens sign-in rather than deciding application permissions. These are complementary parts of IAM, not alternative names for SSO. Source: IAM Ecosystem Explained (04:17-06:47; 09:08-16:36).