IAM: What is Single Sign-On (SSO)

Tags IAM

What Is SSO?

Single Sign-On (SSO) is a tool that lets you use one username and password to log in to multiple applications, such as a website or a desktop application. Instead of remembering different passwords for each application, you only need one, your Villanova Account. Once you're signed in, you can move between approved applications like Blackboard, Self-Service Banner, Outlook Email, Zoom, or OneDrive without logging in again. SSO makes life easier by cutting down on password resets and giving you secure, fast access to the tools you need. In short, SSO streamlines access to the applications you use every day while improving security. Paired with MFA and good monitoring, it's one of the most effective ways to protect accounts and data at the university and is now required for all applications onboarded at the university.

How SSO Works

SSO is built around trust between connected applications. When you log in once, that login is trusted by all connected applications. When you log in, the application issues a secure token (a digital key) that confirms who you are.

Here's what happens or how the login process works:

  1. You sign in through Villanova University's SSO page.
  2. A secure token is created for your verified identity.
  3. When you open another approved application, that application checks with Villanova University's SSO service.
  4. The token confirms your identity, and access is granted and no new login was required.

This entire process uses industry standards such as SAML (Security Assertion Markup Language) and OpenID Connect (OIDC).

Benefits of SSO

  • Stronger security: Fewer passwords to manage reduces risky reuse.
  • Simpler logins: One password for all connected applications.
  • Faster access: Click once, reach many applications.
  • Fewer resets: Fewer Service Desk tickets for lost passwords or troubleshooting login issues
  • Future-ready: Works well with MFA and other security layers.

Common Types of SSO

Type What it Does
SAML Securely shares login data so browser-based applications can sign you in without separate passwords.
OAuth Lets one application access limited info from another (with your permission) without sharing your password.
OpenID Connect (OIDC) Adds user identity on top of OAuth so you can “Sign in with Google/Microsoft/etc.” across applications.
Kerberos Uses encrypted tickets so both you and the application verify each other.
Print Article