Understand federation and single sign-on

In federated identity, one organization’s identity provider (IdP) authenticates a user and provides an assertion to a separately administered relying party. Single sign-on (SSO) lets a user access multiple services through an identity provider session. OAuth is primarily an authorization framework for delegated access; OpenID Connect adds an identity layer on OAuth 2.0. A relying party must validate assertions, audience, issuer, and other protocol requirements.

Federation reduces separate credentials but introduces trust relationships and configuration requirements. Validate signatures and protocol fields, use secure redirects, and scope delegated access. Do not treat an OAuth access token as an identity assertion unless the protocol and validation rules make it one.