How to Implement Single Sign On

When it comes to User Authentication, the classic approach is often the one that's used: collect the user credentials in the application - typically a UserID and a Password - validate them, and you're good to go. It's something that almost every application builder has implemented themselves at some point in their career.

But what if you have multiple applications? Or your user has multiple identities? What if you need to support external identity providers, such as Google, LinkedIn or Twitter, where user authentication is handled by a 3rd party? How about adding support for MFA? And what about supporting Passwordless workflows that do away with passwords altogether?

Well, you could build support in-house, that's true. And we've even put together a comprehensive analysis on doing just that. If your team has the resources, time, capacity, knowledge, and expertise in modern identity technologies - such as OIDC, OAuth 2 and developing a Single Sign On authorization service - then it's definitely an option. But what if there was a better way?

Say hello to Auth0 Universal Login! Universal Login allows you to create a fully customized Single Sign On experience at the push of a button! One that can be integrated across all your applications, and that also provides seamless access to all of the additional capabilities supported by the Auth0 platform.

Single Sign On provides a seamless authentication experience as you navigate through your applications, and works by having a central server (i.e. Auth0) which all the applications trust and leverage - typically via the Browser. When you log in for the first time, a cookie gets created in the context of this central server. Then, whenever you access another application, you get redirected (to the central server), and if you already have a cookie there, you'll get redirected directly to the application without any further login prompt.

With a variety of out-of-box options provided by a wide range of SDKs, you can build an initial integration with almost any application, written in any language, and supporting any technology stack in a matter of hours.

We know that every use case can be different! So if you need additional customization, you can use Auth0’s Actions. Actions are JavaScript functions that run in Auth0 and empower you to control and customize key events in the authentication and authorization pipeline.

We’re HIPAA and SOC2 compliant, which assures you that we comply with all best practices of identity management.If you require an extra layer of security, you can turn on advanced policies like multi-factor authentication, password policies, brute force protection, and much more with just one click!

Discover helpful CIAM articles that are timely and relevant, whatever your level of experience. Whether you prefer to learn by reading, viewing, listening, cloning repos, copying code, or attending a workshop or conference, our content is everywhere and made for developers like you.