Explain like I'm five · Security

What is SSO?

Single Sign-On, told as a story about one pass for the whole town.

Every castle has its own gatekeeper asking.Three castles, three passwords. Easy to mix up.

So people make them all the same.One leak opens all three — the problem from the gatekeeper story.

SSO checks you once and hands you a pass.One thorough check (ring included) at the town entrance. The castles only look at the stamp.

The ID booththe one place that checks who you are

The passa card with the booth's stamp

The castlestrust the stamp and open

One pass opens every castle.No castle asks again. The pass says today only, and cancelling it at the booth shuts every castle at once.

One pass opens everything — for anyone.As risky as it is convenient. So the booth checks the ring too, and the pass is short-lived.

In one breath

SSO = get checked once at the town entrance, then enter every castle with that pass.

Single Sign-On — the thing behind 'Sign in with your work account'. Where OAuth's ticket says 'may enter this room', the SSO pass says 'this is me'.

Identity Provider (IdP): The town's ID booth. Okta, Microsoft Entra ID, Google. The one place that checks who you are.
Service Provider (SP): A castle. An app that trusts the stamp and opens. Also called a relying party.
Token / assertion: The stamped card. The booth's written word that this is me.
Signature: The stamp. Only the booth can make it, so castles can spot a fake.
Session: Today only. How long the pass lives. After that, back to the booth.
Single logout: Cancel at the booth. One cancellation shuts every castle at once.
SAML · OpenID Connect: Two pass formats. The older form (SAML) and the newer one (OIDC), which sits on top of OAuth.
Federation: Trusting the next town's pass. Two booths agreeing to honor each other's stamps.

Want another term as a picture book? Request →