What is single sign-on (SSO), and what is its lifecycle from login to logout?

SSO ("Einmalanmeldung") is an access procedure for several associated but independent applications in which the user has to log in only once; all access ends when the user logs out or the session times out.

The lifecycle has three stages:

1. Log in once: the user authenticates a single time (at the workstation, or at an IdP).
2. Use everything: they gain access to all computers and services, including cloud services, for which they are authorised, for as long as the session lasts.
3. Lose everything at once: when the user signs off, all access rights lapse, either automatically after a set period or when the user performs a single sign-out manually.

The key phrase is "associated but independent": the applications keep their own data and authorisation, but they share one authentication. Benefits: fewer passwords (less reuse and phishing surface), less help-desk work, central control and one place to apply MFA. The flip side is concentration of risk: the SSO session is a master key, so the IdP's login must be strong and logout must really propagate.

Go deeper:

• Single sign-on (Wikipedia) — benefits, criticism and the protocols that implement SSO.