single-sign-on-(sso)
Single Sign-On (SSO) は、1組のログイン資格情報で複数のアプリケーションにユーザーがアクセスできるようにする認証プロセスです。
SSOは、さまざまなシステムやアプリケーションへのアクセスに単一のID検証を可能にすることで、ユーザー認証を合理化します。各サービスで個別のログインを要求する代わりに、ユーザーは一度認証を行い、その後、すべての承認されたリソースへのアクセスを許可されます。これは通常、ユーザーの資格情報を検証し、他のアプリケーションが信頼するトークンまたはアサーションを発行する、信頼できるIDプロバイダーを通じて実現されます。これにより、ユーザーエクスペリエンスが向上し、ユーザーが管理する必要のあるパスワードの数を減らし、攻撃対象領域を最小限に抑えることでセキュリティが強化されます。
graph LR
Center["single-sign-on-(sso)"]:::main
Pre_cryptography["cryptography"]:::pre --> Center
click Pre_cryptography "/terms/cryptography"
Rel_authentication["authentication"]:::related -.-> Center
click Rel_authentication "/terms/authentication"
Rel_authorization["authorization"]:::related -.-> Center
click Rel_authorization "/terms/authorization"
Rel_saas_software_as_a_service["saas-software-as-a-service"]:::related -.-> Center
click Rel_saas_software_as_a_service "/terms/saas-software-as-a-service"
classDef main fill:#7c3aed,stroke:#8b5cf6,stroke-width:2px,color:white,font-weight:bold,rx:5,ry:5;
classDef pre fill:#0f172a,stroke:#3b82f6,color:#94a3b8,rx:5,ry:5;
classDef child fill:#0f172a,stroke:#10b981,color:#94a3b8,rx:5,ry:5;
classDef related fill:#0f172a,stroke:#8b5cf6,stroke-dasharray: 5 5,color:#94a3b8,rx:5,ry:5;
linkStyle default stroke:#4b5563,stroke-width:2px;
🧠 理解度チェック
🧒 5歳でもわかるように説明
It's like having a master key that unlocks all the different doors in your house, so you only need to use one key instead of a separate one for each room.
🤓 Expert Deep Dive
SSO implementations typically rely on federated identity management protocols. SAML 2.0, a widely adopted standard, uses XML-based assertions exchanged between an IdP and SPs, often facilitated by browser redirects (HTTP POST binding). OAuth 2.0, primarily an authorization framework, is frequently used in conjunction with OpenID Connect (OIDC) for authentication. OIDC builds upon OAuth 2.0, adding an identity layer that provides user profile information and a standardized ID token. Key architectural components include the Identity Provider (authenticates users and issues tokens), Service Providers (rely on IdP for authentication), and the user's client (facilitates token exchange). Security considerations involve robust token validation (signature verification, expiration checks, audience restriction), secure transport (TLS/SSL), and protection against token replay attacks. The trade-off is the increased criticality of the IdP; a compromise of the IdP can lead to widespread access breaches across all connected SPs.