What Is SSO Federation and How Does It Work?

What is SSO federation?

SSO federation is an arrangement in which one organization agrees to trust another organization's verification of who you are. Instead of each system holding its own copy of your password, one system — the identity provider — checks your identity, and the others accept its word.

Single sign-on, or SSO, is the experience you get from that arrangement: sign in once, and several separate applications let you in without asking again. Federation is the trust relationship underneath that makes it possible across organizational boundaries, such as between your employer and an outside supplier's software.

How is federation different from ordinary single sign-on?

Plain SSO can happen inside one organization, with one directory covering all its own applications. Federation is what you need when the applications belong to someone else. Your employer keeps the accounts and the passwords; the outside application keeps none of that and simply accepts a signed statement from your employer saying that you are you.

The practical consequence for you as a user: when a federated sign-in fails, the fix is almost always on your own organization's side, not on the site you were trying to open.

What do the terms mean?

• Identity provider, often shortened to IdP: the system that holds your account and verifies you. Usually your employer's or school's directory.
• Service provider, or relying party: the application you are trying to open, which relies on the identity provider's answer.
• Assertion or token: the signed digital statement the identity provider sends, saying who you are and when it checked.
• Claims or attributes: the individual pieces of information inside that statement — your email address, your name, sometimes your group memberships.
• SAML and OpenID Connect: the two common languages in which that statement is written. Older enterprise setups tend to use SAML; newer ones tend to use OpenID Connect.
• Federated domain: an email domain that has been configured to send its sign-ins to a particular identity provider.

How does a federated sign-in actually flow?

1. You open the application and are asked for your email address, but not yet for a password.
2. The application looks at the domain part of the address and recognises it as federated.
3. Your browser is redirected to your organization's identity provider — this is the moment the address bar changes to something you may not recognise.
4. You sign in there with your organization's password and any second factor it requires.
5. The identity provider sends a signed assertion back through your browser to the application.
6. The application checks the signature, reads the claims, and creates your session.

The whole sequence usually takes a second or two, which is why most people never see steps three to five. When something breaks, you notice them all at once.

Why does a federated sign-in fail?

• Your password was changed and the browser is still offering the old one to the identity provider.
• The account is disabled, locked, or has expired at the identity provider. The application will still say the credential is invalid, which points you in the wrong direction.
• You are not licensed or not assigned to that application, so identity succeeds and authorization fails.
• Your device clock is wrong. Assertions carry a validity window, and a clock off by minutes can put you outside it.
• A required claim is missing, most often the email address the application uses to match you to an existing profile.
• You have two accounts — a personal one and a work one — and the browser is signed into the wrong one.
• The signing certificate on the trust relationship expired. This breaks it for everyone at once, which is a useful thing to check by asking a colleague.

What can you try yourself before contacting the helpdesk?

1. Open a private or incognito window and try again. This eliminates cached sessions and wrong accounts in one step.
2. Clear cookies for both the application and the identity provider, not just one of them.
3. Check the system clock and time zone on your device and set it to update automatically.
4. Try a different browser, then a different network. Some federated setups behave differently outside the corporate network.
5. Sign in to another application that uses the same identity provider. If that also fails, the problem is your account, not the application.
6. Read the exact error text and capture it, including any correlation or request identifier.

What should you tell your IT helpdesk?

Give them six things: the application you were opening, the email address you used, the exact error text, any correlation or request identifier shown, the date and time with your time zone, and whether the same account works elsewhere. That identifier is the single most useful item, because administrators can look up the failed sign-in directly rather than reproducing it.

Say explicitly whether this ever worked before and when it last worked. Federation problems split cleanly into never-worked, which is usually configuration, and stopped-working, which is usually an expiry or a change.

Is federation the same as signing in with a social account?

The mechanism is closely related, but the trust is different. Signing in to a shopping site with a personal account from a large platform uses the same style of redirect and token. Federation in the workplace sense means a formal, negotiated trust between two organizations, with agreed claims and an administrator on each side. The user experience looks identical; the accountability behind it does not.

What does federation mean for your password?

Under federation, the application you are opening never receives your password — only the signed statement. That is the security benefit: fewer places hold the secret. It also means the password reset link inside that application is often useless to you, because it can only reset a password that does not exist there. Reset at your identity provider instead, which for most organizations is the same place you change your workstation password, reachable from the company’s official website if your organization publishes it there.