What is SSO (Single Sign-On)?

Short answer

SSO (Single Sign-On) is the user authenticating once and accessing more than one application without entering the password again; the identity is verified at a single point, and the applications trust this verification. In TR7, SSO is used in three forms: AGS connecting to an external IdP with an Authentication Provider of the SAML 2.0, OpenID Connect or OAuth2 type; a user who logs in once on the AGS-enabled vService whose Gateway Mode setting is Portal passing, without logging in again, to the Portal Application vServices that add that portal to their Trusted Portals list; the identity of the verified user being passed to the application behind it with the Backend SSO Configurations profile as a header, Basic Auth, Bearer Token or cookie.

Where It Is Used in TR7

Where	Field / label	What for
AGS → Authentication → Authentication Providers	Provider Type = SAML 2.0, OpenID Connect, OAuth2	Logging in once at an enterprise or external IdP
AGS-enabled vService → Flowchart	Gateway Mode = Portal	The central vService where the user logs in and that produces the identity
AGS-enabled vService → Flowchart	Gateway Mode = Portal application; Trusted Portals	The application vService that takes over the identity from the portal it trusts; the list cannot be left empty
AGS → Authentication → Authentication Providers	Provider Type = Portal; Portal Gateway	Obtaining the identity from another AGS-enabled vService in portal mode
AGS → Integrations → Backend SSO Configurations	Injections: Type = Header, Basic Auth, Bearer Token, Cookie	Passing the verified identity to the application behind it; the application does not ask for a login separately

SSO Forms

Form	Who verifies the identity	What the user sees
With an external IdP (SAML 2.0, OpenID Connect, OAuth2)	Enterprise or external IdP	If the user has a session at the IdP, the user does not enter the password again
Portal and Portal application	The AGS-enabled vService in portal mode	Logs in once at the portal and passes directly to the connected applications
Backend SSO Configurations	AGS, with any provider in the flow	Does not see the application's own login page

Common Misconceptions

• "SSO shares the password between applications." In SSO, the password is entered only at the authentication point; the applications see not the password but the signed identity or the session provided by that point.
• "When SSO is on, a second factor is no longer needed." SSO reduces the number of logins, and MFA increases the strength of the login; the two are used together (What is the difference between MFA and 2FA?).
• "Backend SSO Configurations is an IdP connection." This profile does not verify the user; it adds the identity that AGS has already verified to the request in the format the application behind it expects.

How it is done in the documentation

• AGS · Three Operating Modes
• Portal Application · What Is Portal Application?
• Backend SSO Configurations · What Are Backend SSO Configurations?
• AGS · Authentication Options

Related questions

• What is SAML 2.0?
• What is OpenID Connect (OIDC)?
• What is identity federation?
• What is a Bearer Token?