
According to the **Atlassian announcement** that came out in October 2020, new server license sales have come to end on 2nd February 2021. Server support for existing licenses will continue to be offered by Atlassian until Feb 2024. However, maintenance and support pricing would increase for server licenses. Atlassian is providing all its server customers three years of time to migrate to the Data Center or Cloud depending on their business needs.

Focusing on the existing server licenses, until 2nd Feb 2022, Atlassian will provide support [database, java, browser] and bug fixes for server products. Beyond that, Atlassian will only provide security bug fixes for critical vulnerabilities until the products will reach the end of support i.e. 2nd Feb 2024. Server customers will also experience an increase in maintenance costs. Also, upgrading and downgrading of user tiers for server products and applications will be limited till 2nd Feb 2022.

&nbsp;&nbsp;  

**Impact on Atlassian Marketplace Add-Ons**

- Existing server customers can still purchase server apps/ add-ons available on Atlassian Marketplace till 2nd Feb 2023. 
- Renewals for atlassian marketplace add-ons will also continue till “2023”. 
- Beyond that, you won’t be able to renew your add on license which implies end of server life in Atlassian.
- If you have a Data Center instance, you will need to purchase a Data Center subscription of the add-on provided, the DC version is available on Marketplace.
- If there is no Data Center version available, you can continue to use the server version of the app, though it comes with some risk as the app has not received an architecture review or been performance tested to ensure it can scale in a Data Center environment.
- Whenever a Data Center version becomes available, you will then need to purchase a Data Center subscription to use it on your Data Center instance.

As a customer centric [Atlassian SSO vendor](https://marketplace.atlassian.com/vendors/1213308/miniorange), we are committed in helping our server customers to migrate to Data Center. We will be providing full support and maintenance for all our Server add-ons till 2024.

&nbsp;&nbsp;  

Reach out to us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket by [clicking here.](https://miniorange.atlassian.net/servicedesk/customer/portal/2)

Atlassian server support is ending in February 2024. Existing customers have three years to migrate to Data Center or Cloud. Server support will be limited after February 2, 2022, with no new bug fixes or features. Marketplace add-on sales and renewals will end on February 2, 2023. miniOrange will be providing migration support for customers.

Atlassian Server is gone but Marketplace Add-ons stays with you!


With an increasing number of cloud applications being adopted by customers, the need for providing a seamless user experience to employees and other end users is high. In this blog, our objective is to delve into the basics of SAML and discuss SSO through SAML, which can be initiated in
two ways: IDP-initiated SSO and SP-initiated SSO.

### SAML {#saml}

In simplest terms, [SAML (Security Assertion Markup Language)](https://www.miniorange.com/what-is-saml) is an open standard for transferring identity data between two elements, Identity Provider (IdP) and Service Provider (SP). In this blog, we will examine what is the difference between SP-initiated and IdP-initiated SSO flows.

### What is an Identity Provider (IdP)? {#what-is-an-identity-provider-idp}

The user credentials and other identifying information are stored and managed by an Identity Provider (IdP) centralized system. IdP is a trusted system that provides access to other websites and applications. Additionally, it also authenticates a user XYZ as a user XYZ after credentials are entered.

An IdP offers [authentication services](https://www.miniorange.com/products/authentication) to relying applications, through this, it is possible to use [Single Sign-On (SSO)](https://www.miniorange.com/products/single-sign-on-sso) and access other websites. [miniOrange Identity Server(IdP)](https://www.miniorange.com/iam/) provides centralized, simple management and synchronization of identities for users, devices, and things. As a result, it can be tailored to almost any use case and workflow.

### How does IdP-initiated authentication work? {#how-does-idp-initiated-authentication-work}

In IdP-initiated authentication, users first log in to their dashboard, which presents an application catalog. This catalog will contain visual icons of all the internal and external applications that the admin has configured SSO for their end user and that the end user has the privileged to access those applications. Only configured external and internal applications are visible in the end-user dashboard when you try IdP-initiated SSO

IdP-initiated authentication involves users logging in through the login screen of their Identity source, where their user credentials are stored. After successful login, users are presented with an application catalog on their dashboard, displaying visual icons of all the internal and external applications that the admin has configured for SSO access by the end user. It is important to note that only the external and internal applications that have been configured for SSO access will be visible on the end-user dashboard during IdP-initiated SSO.

![Xecurify EndUser Dashboard](/blog/assets/2023/xecurify-enduser-dashboard.webp)

When the user clicks on any of the application icons visible, the SAML flow is as follows:

- The user’s identity and some other details are sent by the Identity Provider (IdP) to the Service Provider (SP).
- The IdP creates a document called SAML Assertion, which contains the information sent by the IdP to the SP.
- The IdP uses a private key to sign the SAML Assertion document. This key was shared between the IdP and SP when they established SSO trust.
- The IdP sends the SAML Assertion to the SP using the user’s browser, or it sends a reference that the SP can use to securely retrieve the SAML Assertion.

### Service Provider (SP) {#service-provider-ap}

In the context of SSO, a service provider is responsible for providing services to the end user. However, service providers do not authenticate users themselves. Instead, they rely on an identity provider (IdP) to verify the user’s identity and manage specific attributes related to the user. Put simply, service providers request authentication decisions from the IdP, which holds the account information and unique attributes related to the user for the given service.

### How does SP-initiated SSO work? {#how-does-sp-initiated-sso-work}

- SP-initiated SSO happens when a user tries to access an application at the SP end but hasn’t been authenticated by the IdP yet.
- If the user has no active browser session, the SP will redirect them to the IdP to request authentication.
- Further, the IdP will authenticate the user and create a SAML assertion, which is then used to redirect the user back to the SP.
- How does SP know which IdP to redirect the user to?  if it supports a single sign-on from more than one IdP.

![Xecurify Login screen](/blog/assets/2023/xecurify-login.webp)

These are the ways how the SP can determine which IdP to redirect the users to:

- The SP may ask for the user identity such as the user’s email address and use the domain of the same, such as jon@miniorange.com, to determine which Identity Provider (IdP) to use from multiple configured IdPs.
- The SP will show the user a list of IdPs it supports and asks the user to select the one IdP from which they want to authenticate themselves.
- The resource URL may be specific to one IdP.
- The SP may have restored a cookie containing IdP information in the user’s browser session the first time the user successfully logged in from the IdP and will use this user’s information on further subsequent accesses.

Once the SP has received the SAML assertion, it validates the signature using the public key to ensure the SAML assertion came from the trusted IdP and no attributes have been modified in the SAML assertion. The SP can then extract the user’s identity from the SAML assertion and other needed details. At this point, the user is on the service provider’s landing page, just as though they had logged into the site manually.

### Difference between SP-Initiated vs IdP-Initiated SSO {#difference-between-sp-initiated-vs-idp-initiated-sso}

In the process of **SP-initiated login**, the user initiates a login request through the application. They are redirected to the IdP’s miniOrange login page for authentication. The IdP checks if a Windows session exists and retrieves the credentials of the currently logged-in user. It then generates a SAML response, which is used by the miniOrange SSO service to log in the user into the application.

In the case of **IDP-initiated login**, the user logs in directly to the IdP instead of the application dashboard. The IdP generates a SAML response, which is used to log in the user to the applications.

### Benefits of SP-initiated SSO (Single Sign-On) {#benefits-of-sp-initiated-sso-single-sign-on}
SP-initiated SSO (Single Sign-On) allows users to access multiple applications with a single set of login credentials, initiated from the service provider’s (SP) application. 

**1. Improved user experience**:  Seamless, user-friendly experience and ability to access multiple applications with a single login.

**2. Reduced password fatigue**: Using a single login credential eliminates password fatigue and improves security.

**3. Increased security**:  Enables centralized authentication and access control, which reduces the risk of unauthorized access to applications.

**4. Simplified administration**: It simplifies the administration of multiple applications, as user access and permissions can be centrally managed from the SP application.

### Benefits of IDP-initiated SSO

**1. Greater control and visibility**: IDP provides greater control and visibility over user authentication and access to applications.

**2. Enhanced security**: IDP’s strong authentication and access control policies can enhance security and detect suspicious behavior.

**3. Simplified administration**: Centralized management of user access and permissions simplifies administration.

**4. Lower dependence**: IDP-initiated SSO reduces dependence on the SP application and improves reliability.

### Conclusion {#conclusion}

In conclusion, SP-initiated SSO allows users to access multiple applications using a single set of login credentials, initiated from the service provider’s application. This method offers several benefits such as improved user experience, reduced password fatigue, increased security, and simplified administration. However, it also has some drawbacks, including dependency on the SP application, potential security risks, increased complexity during implementation, and compatibility issues.

On the other hand, IDP-initiated SSO provides greater control and visibility over user authentication and access to applications, enhanced security, and simplified administration. It also reduces dependence on the SP application and improves reliability. However, implementing IDP-initiated SSO may also face challenges, such as increased one time complexity during implementation due to coordination between the IdP and individual applications, potential compatibility issues, and the risk of unauthorized access if the IdP is compromised.

### miniOrange offerings {#miniorange-offerings}

miniOrange provides a comprehensive SSO solution that simplifies the implementation of both SP-initiated and IDP-initiated SSO. Their solution offers a variety of authentication protocols, including SAML, OAuth, JWT, and OpenID Connect, and allows for seamless integration with various applications. Additionally, miniOrange’s SSO solution provides enhanced security features, such as multi-factor authentication and adaptive risk-based authentication, to ensure secure access to applications. Overall, miniOrange’s solution can help organizations implement SSO in a hassle-free manner while ensuring the highest level of security.
### Further Reading {#further-reading}

- [What is SAML?](https://www.miniorange.com/what-is-saml)
- [What is Single Sign-On SSO?](https://blog.miniorange.com/what-is-single-sign-on-sso/)
- [SAML Single Sign-On Integration](https://www.miniorange.com/iam/integrations/?id=saml)
- [WordPress SAML Single Sign-On](https://plugins.miniorange.com/wordpress-single-sign-on-sso)
- [WordPress OAuth Single Sign-On](https://plugins.miniorange.com/wordpress-sso)

Learn more about SP and IdP initiated SSO, what it is , and specific differences between SP vs IdP initiated Single Sign-On SSO login.

SP-Initiated vs IdP-Initiated SSO


If you're an e-commerce store owner and your online store is built on Adobe Commerce (formerly Magento), you know how important it is to provide a seamless and secure login for your backend users (admins) and Frontend users (customers). 
Adobe Commerce, formerly known as Magento, is a highly customizable and robust e-commerce platform that has evolved to meet the growing needs of businesses worldwide.

One of the best ways to achieve Single Sign-On is by [implementing Magento 2 SSO](https://plugins.miniorange.com/magento) for your store. Magento SSO extension by miniOrange allows your users to log in into your Magento store using Identity Provider (IDPs) credentials. Let's see how you can easily implement SSO on your Adobe Commerce store using the miniOrange SSO extension.

### Understanding Single Sign-On (SSO) {#understanding-single-sign-on-sso} 

Single Sign-On (SSO) allows your users to login into various applications with a single set of login credentials. Your users only need to remember one set of login credentials to access various systems and applications. This not only enhances the user experience by reducing the number of times they have to log in but also increases security by minimizing password exhaustion.  


### Why Choose miniOrange SSO Extension for Magento 2? {#why-choose-miniorange-sso-extension-for-magento-2}

miniOrange is a well-known name in identity and access management, offering a robust SSO solution for Magento 2. Here are a few reasons why miniOrange stands out:
- miniOrange SSO extension for Magento is easy to install and configure, even if you're not a tech expert.
- Supports various protocols like SAML, OAuth, and JWT, ensuring compatibility with different and every identity provider out there.
- Supports both Backend (Admins) and Frontend (Customers) users.
- Support for multi-store and multi-site Magento environments.
- Allows you to easily integrate multiple Identity Providers that facilitate your users to login into Magento using different providers credentials. 
- Auto creates users in Magento if the user is not already present in the Magento database. 
- Force authentication and auto-redirect your users to login via their Identity Provider credentials only. 
- Seamless support for all three versions of Adobe Commerce (Magento) i.e Community, Enterprise, and Cloud versions.
- Frequent updates according to the latest security patches and Magento versions.
- Advance Attribute Mapping with support for custom attribute mapping to easily map the attributes coming from your Identity Provider.
- Advance Role Mapping.
- Additional support for features like multi-factor authentication (MFA) & OTP verification to secure your store and verify every user coming to your store.
- Detailed documentation and support make the setup process easy and straightforward.  


### What are the benefits of Implementing SSO for your Magento 2 Store? {#what-are-the-benefits-of-implementing-sso-for-your-magento-2-store}

- **Enhanced User Experience:** SSO allows your customers to access your Magento 2 store with a single set of credentials, streamlining the login process. This convenience reduces the hassle of remembering multiple usernames and passwords, leading to a smoother and more enjoyable shopping experience.
- **Increased Security:** By centralizing authentication, SSO can enhance security. It reduces the risk of weak passwords being used across multiple sites, lowers the chances of phishing attacks, and allows for the implementation of stronger authentication methods, such as multi-factor authentication (MFA).
- **Improved Conversion Rates:** Simplifying the login process can reduce friction at critical points in the customer journey, such as account creation and checkout. This ease of access can lead to higher conversion rates and fewer abandoned carts, increasing sales and revenue.
- **Streamlined User Management:** For admins, SSO simplifies user management by centralizing the authentication process. This makes it easier to manage user access, enforce security policies, and integrate with other systems, ultimately saving time and reducing overhead.


### How to set up SSO for your Magento 2 store (In three easy steps)? {#how-to-set-up-sso-for-your-magento-2-store}

1. Download the miniOrange SSO extension for Magento 2 from the Magento Marketplace and install it on your Magento site. You can follow the complete installation [video](https://www.youtube.com/watch?v=ZPzm6RlmieI) guide to easily install the extension.
2. After installation, configure the Single Sign-On application in your Identity provider by configuring your Magento store URL as a Redirect / Callback URL on IDP and bring back the Client ID and Client secret from your IDP side.
3. Configure Client ID and Client secret received from IDP in Magento 2 SSO extension to establish a successful Single Sign-On connection.  

You can check out the complete step-by-step setup guides with different Identity Providers from [here](https://plugins.miniorange.com/magento-sso-single-sign-on-with-oauth-openid-connect-setup-guides).


### Best Practices for SSO Implementation {#best-practices-for-sso-implementation}
Implementing SSO includes more than just technical setup. Adopting best practices ensures a smooth and secure integration:  

**Security Best Practices**
- Use Strong Authentication Methods: Ensure that your IdP supports strong authentication methods such as multi-factor authentication (MFA). MFA adds an extra layer of security, making it more difficult for attackers to gain unauthorized access.
- Regularly Update Certificates: Periodically update the public certificates used by your IdP to sign SSO responses. This ensures continued trust in the authentication process.
- Monitor for Suspicious Activities: Regularly monitor for suspicious login activities and take swift action if any anomalies are detected. This includes setting up alerts for unusual login patterns or failed login attempts.  

&nbsp;  

**User Experience Best Practices**
- Communicate with Users: Inform users about the new SSO system and provide clear instructions on how to use it. This helps in reducing confusion and ensures a smooth transition.
- Provide Support Resources: Offer support resources such as FAQs, user guides, and a helpdesk to assist users with any issues they might encounter during the SSO login process.
- Gather Feedback: Collect feedback from users to identify any issues or areas for improvement. Use this feedback to refine the SSO implementation and enhance the user experience.  

&nbsp;  

**Technical Best Practices**
- Regular Backups: Perform regular backups of your Magento store and SSO configuration settings. This ensures that you can quickly restore your system in case of any issues.
- Scalable Infrastructure: Ensure that your infrastructure can handle the increased load that may result from implementing SSO. This includes having adequate server resources and optimized database performance.
- Testing and Staging: Always test changes in a staging environment before deploying them to production. This helps in identifying and fixing any issues without affecting live users.


### Closing Notes {#closing-notes}

Implementing SSO in your Magento 2 store using the miniOrange SSO extension can highly improve user experience and enhance security. You can seamlessly provide your users with a convenient and secure way to access your store.
Give miniOrange Magento 2 SSO extension a try and see the difference it can make for your business.


### Additional Resources {#additional-resources}

- [Download and read more about Magento (Adobe Commerce) SSO extension](https://commercemarketplace.adobe.com/miniorange-inc-miniorange-oauth-sso.html)
- [Magento 2 SSO extension features and pricing plans](https://plugins.miniorange.com/magento-oauth-single-sign-on-sso#pricing)
- [Other Security Solution for your Magento Store](https://plugins.miniorange.com/magento-2-extensions)



Magento 2 SSO extension by miniOrange allows your frontend users (customers) as well as backend users (admins) to log in into your Magento store using Azure AD / Microsoft Entra ID, Azure AD B2C, Okta, Salesforce, Keycloak, Auth0, ADFS, and any other SAML and OAuth compliant Identity Provider (IDPs) credentials.

Implementing SSO on Adobe Commerce (Magento 2)


Cloud technology is undeniably considered paramount everywhere in the tech market. The rationale behind this is the emerging growth of Cloud technology in multiple businesses and enterprises to manage Data / Services which helps them to streamline their organizational process. G Suite is one of the most favored user-friendly Cloud technology, which is easily accessible from any device or location, irrational to organizational access parameters. G Suite continuously strives to supply additional features uniformly for the convenience of users. But still, there are a few aspects in G Suite that can’t be easily handled around access control and device management, due to the frontline feature that Google always promises of “anytime, anywhere and with any device”.

Easy cloud access to G Suite also brings up a set of challenges associated with security concerns to stop your data from being accessed by unauthorized users protecting it from various sorts of cyber threats. Maintaining the safety of such broad-driven cloud applications (Gmail, Google Drive) is one of the challenges within the modernized world. Here IP restriction for G Suite comes within the frame and is considered one of the proven solutions for handling these sorts of use cases.

To get specific inference regarding what **G suite IP restriction** is and the way it works we’d like to urge clear about a few basic aspects:-

- **What is IP restriction for G Suite?**
- **Why does your organization need IP restriction for G Suite?**
- **Why use miniOrange to protect your G Suite Data?**

### What is IP Restriction for G Suite? {#what-is-ip-restriction-for-gsuite}

IP Restriction termed as Internet Protocol Restriction allows admin or organization owners to restrict access to their business data to respective users and employees only through the specified and registered IP addresses. Allowing or restricting user access is often achieved with a separated IP as well as a variety of IP addresses. The IP restrictions are often set of different levels and combinations like defined IP ranges or individual IP addresses. Enabling IP restriction for G Suite ensures that your important data can’t be accessed at an unsecured public place or through an unregistered IP address.

Considering a real-time example, in a corporation you being an admin have whitelisted your employee’s device’s [Mobiles, PC’s] IP addresses and accordingly permitted access to your organization data. Now suppose if an employee is using the whitelisted device in an organization’s premises i.e he can easily access data and work around it accordingly. For a short time, if he tries to access data from his device being home, he won’t be allowed to access data as his device isn’t whitelisted by admin and secondly, he’s not operating the device from the required location he’s alleged to be.

IP restriction is enabled for various security purposes like reducing redundancy, bandwidth issues, and handling control of websites with efficient recovery. If a user tries to log in outside the required range, it’ll throw an error and a specific employee/ user won’t be unable to login and access the info. This feature is employed in various organizations within the Finance industry, Logistics, E-Commerce industry, Automobile segment, Manufacturing sector, IT industry, Educational sector, and Healthcare sector (KPOs).

### Why does your organization need IP restriction for G Suite? {#why-does-your-organization-need-ip-restriction-for-gsuite?}

Startups, mid-level organizations, and enormous enterprises are shifting over advanced cloud services to streamline their processing. G Suite, one of the foremost used cloud technologies, offers piles of services like Emailing, Google Calendar, Document – Presentation, file sharing, video apps, etc in a single package. As Google suite provides multiple offerings to numerous people directly, G Suite must cope up with multidimensional cloud computing security challenges. Although Google as a brand keeps no stone unturned to keep their users’ data safe with robust security protection, it still becomes difficult to cope up with distinct cyber threats within the cyber world.

Therefore, multiple cloud security companies came with the feature of IP restriction for G Suite. It enables the admin to shortlist IP addresses or a specific range of addresses, which then lets users transfer data or do further services from those registered IPs only. This IP restriction method indirectly prevents spoofing through manual defining of  IP ranges. Overall, there exist two ways of enabling IP restriction for Google Suite, One through a manual process or third-party cloud Security vendor.

### Why use miniOrange to protect your G Suite Data? {#why-use-miniOrange-to-protect-your-gsuite-data?}

Enabling IP restriction for G Suite manually demands a high-versed technical person to handle the utilization case. If the person lacks technical knowledge and performs something wrong then your G Suite cloud security risk level might increase unexpectedly. So here we need an advanced cloud security system that will overcome these issues and provide a top-notch security solution to your G suite organizational data.

Here miniOrange comes in and offers all-in-one protection measures to the businesses using G Suite. It also renders g suite security with IP restriction standards to supply high-level security to your organizational G Suite data. To implement **[IP restriction for G Suite](https://www.miniorange.com/configure-google-workspace-ip-restriction)** for your organization or business is a simple walk with miniOrange. You don’t have to put in extra effort as an enterprise to disturb the implementation of Google account security during a business.

miniOrange takes full control and visibility of organizational data, which is stored on Google. It also allows IT administrators to analyze the employee’s behavior towards enterprise data. On detection of a possible breach, it instantly sends an alert email message to notify higher business authorities. miniOrange also renders the program to enforce access control standards at the macro level on the idea of the device, IP address, time, browser, geolocation, etc.

You can follow the steps given here to set up IP restrictions and other **[Adaptive MFA](https://www.miniorange.com/products/adaptive-multi-factor-authentication-mfa)** methods for your applications. 

![G Suite IP restrictions](/blog/assets/2023/gsuite-features.webp)

**G Suite Automated Security Measures provided by miniOrange:**

Following listed are security measures provided by miniOrange,

**1. Access Control** : Access control specifies data control policies on the idea of location, device, IP address, and other means through which  G Suite content is often accessed. It imposes conditional policies on customer’s Google for business accounts and creates a virtual secure environment.

- [IP Restriction](https://www.miniorange.com/configure-google-workspace-ip-restriction): Restricts user access from unknown IP addresses to ensure corporate data is accessible only through IPs defined by the IT admin.
- [Geo (Location) Restriction](https://www.miniorange.com/configure-google-workspace-location-restriction#:~:text=On%20the%20Add%20Policy%20tab,the%20UP%20%26%20DOWN%20navigation%20keys.): Here a selected geographical area is assigned, to stop corporate data from being accessed from unauthorized remote locations.
- [Time Restriction](https://www.miniorange.com/configure-google-workspace-time-restriction): In time restriction, you as a corporation can fix specific timings, so hereafter any employee can access and work around corporate data within a specified time-frame. (e.g working hours)
- Browser Restriction: With miniOrange you’ll  register a specific browser, so hereafter an organizational employee can access corporate data as long as he’s using the required registered browser
- [Device Restriction](https://www.miniorange.com/configure-google-workspace-device-restriction): In Device Restriction user’s relatable devices like his mobile or Pc are going to be registered, if a specific user tries to log into the enterprise portal through unregistered or unknown devices he won’t be allowed to access

**2. DLP Policy**: Data loss prevention standard policy is appended by miniOrange during this consolidated Google Security software. These policies make sure that employees won’t send confidential business information outside the business network. Whenever the IP restriction for G Suite solution detects the occurrence of such an incident, it immediately blocks the user access and sends an alert mail to the business authority.
Aside from this, many other subsequent security measures are provided by miniOrange.

**Specific G-Suite security features provided by miniOrange:**

- Administrators can prefer to apply rules to specific individuals, groups, or the whole organization differently.
- Rules are often set during a hierarchy, allowing flexible management.
- Predefined IP locations white list where a user is allowed to access from.
- No firewall or installations are required.
- Easy policy settings.

### Conclusion {#conclusion}

Being a neighborhood of the high-versed cyber world, it’s an important need of enterprises to adopt a high-versed Security Solution for G Suite. To manage advanced security for the G suite with other multiple activities becomes a daunting task for an organization and IT admins. Though it’d be difficult to manage security norms it’s the necessity of the time considering trending cyber-attacks. So it’s better to approach security-as-a-service providers. There are few cloud security providers, which give top-notch security services. But before choosing any cloud Security Service provider ensure they did it confidentially, with the simplest technical support at a budgeted price. Accordingly, I feel miniOrange here fits within the best considering these points. You can schedule a free demo with them to ascertain how IP restriction for G Suite works and how it can add an extra edge to your organizational security.

### Further Reading {#further-reading}

- [What is IP Restriction?](https://www.miniorange.com/iam/solutions/ip-restriction#:~:text=IP%20Restriction%20Solution%20allows%20administrators,and%20registered%20IP%20addresses%20range.)
- [Google Workspace Multifactor Authentication](https://www.miniorange.com/google-apps-two-factor-authentication-(2fa))
- [Adaptive Authentication ](https://www.miniorange.com/products/adaptive-multi-factor-authentication-mfa)
- [Risk-based Authentication (RBA)](https://www.miniorange.com/iam/solutions/risk-based-authentication-rba)

IP Restriction for G Suite allows secure login and restricts unauthorized access based on IP address, geolocation, time, and the device.

What is G Suite IP Restriction? Enable IP Restriction for G Suite


### What is SSO? {#what-is-sso}

**Single Sign-On (SSO)** is an authentication process in which a user is provided access to multiple applications and/or websites by using only a single set of login credentials (such as username and password). This prevents the need for the user to log separately into the different applications.

The user credentials and other identifying information are stored and managed by a centralized system called Identity Provider (IdP). The Identity Provider is a trusted system that provides access to other websites and applications.

Single Sign-On (SSO) based authentication systems are commonly used in enterprise environments where employees require access to multiple applications/websites of their organizations. In this scenario, the Single Sign-On service provider uses the organization’s directory, such as Microsoft Active Directory, [Azure Active Directory](https://www.miniorange.com/blog/what-is-azure-active-directory/), or a directory provided by the Single Sign-On solution itself for authenticating users and providing access to the various applications/websites.

### How does Single Sign-On (SSO) work? {#how-does-single-sign-on-sso-work}

![Single Sign On Workflow](/blog/assets/2023/sso-workflow.webp)

The authentication process using miniOrange Single Sign-On (SSO) takes place as described in the following steps:

- The user requests a resource from their desired application/website.
- The application/website redirects the user to miniOrange (Identity Provider) for authentication.
- The user signs in with their miniOrange credentials if no external IdP is configured. If you have an existing Identity Provider (SAML, OAuth/OpenID Connect, etc), miniOrange redirects the user to the existing Identity Provider for authentication.
- The IdP sends a Single Sign-On response to miniOrange.
- miniOrange returns a Single Sign-On response back to the client application/website and
- The application/website grants access to the user.

Now, the user can access all other applications/websites which are configured for SSO. If the user wants to access a resource from another application/website, the application/website checks whether the user has an active session with miniOrange.

### Single Sign-On (SSO) Components {#single-sign-on-sso-components}

- **Identity provider** - User Identity information is stored and managed by a centralized system called Identity Provider (IdP). The Identity Provider authenticates the user and provides access to the service provider. The identity provider can directly authenticate the user by validating a username and password or by validating an assertion about the user’s identity as presented by a separate identity provider.
The identity provider handles the management of user identities in order to free the service provider from this responsibility.
- **Service Provider** - A service provider provides services to the end-user. They rely on identity providers to assert the identity of a user, and typically certain attributes about the user are managed by the identity provider. Service providers may also maintain a local account for the user along with attributes that are unique to their service.
- **Identity Broker** - An identity broker acts as an intermediary that connects multiple service providers with various different identity providers. Using Identity Broker, you can perform single sign-on over any applications without the hassle about the protocol it follows. No need to understand or implement complex SSO protocols like SAML, OpenID, OAuth, CAS or any other. Instead, you can just call the HTTP endpoints and access any identities. The important reason why we should use Identity Broker is that it supports Cross Protocol i.e. configuring Service Provider following a particular protocol with an Identity Provider following some different protocol.

### Key factors to know before implementing SSO {#key-factors-to-know-before-implementing-sso}

Single Sign-On solution is implemented according to the requirements of the client. The implementation will differ from user to user regarding their objectives & needs. That being the case, there are some key factors you should keep in mind before implementing SSO for your system.

- Types of users: If they are permanent/temporary, the number of users should be kept in mind.
- Access: Proper authorization should be given to users according to their designation and or requirements.
- Platform: According to your needs choose whether you want On premises solution or a Cloud Based solution.
- Features: What features are you looking for to ensure only trusted users are logging in? MFA, Adaptive Authentication, Device Trust, IP Address Whitelisting, etc. should be considered. 
- What systems do you need to integrate with?
- Keep educating your employees about password best practices. Let them know what SSO is and how you make the best use of it.

### Benefits of Single Sign-On (SSO) {#benefits-of-single-sign-On-sso}

**How SSO can benefit users?**

- Ease of use: Users only need to remember one set username & password. Eliminating the inconvenience of managing, remembering, and resetting multiple passwords, thus improving productivity with higher conversion rates.
- Transparency: Users know what’s being shared from one system to another. They have all the access to their sensitive information and whom to share it with.
- Ease of access: With Single Sign-On, users don’t have to go through lengthy sign-up and authorization processes.

**How SSO can benefit business?**

- Increased productivity: Employees need access to many apps throughout their workday. They have to spend some time logging in to all those apps with the added difficulty of remembering all the passwords. With Single Sign-On, users can enter just one password to access all of their apps, skip all that extra time spent logging in and use that time more productively.
- Reduced IT cost: Enabling SSO allows users to manage individual dashboards and self-reset passwords, which eliminates the necessity of IT support, saves admin time on password resets and supports tickets to focus on more important tasks. This indirectly helps in reducing IT costs.
- Security and compliance: Security and Compliance factors enforce organizations to prove that they have taken adequate security measures to protect sensitive data. Single Sign-On helps with regulatory compliance to meet data access and security risk protection requirements.
- More user sign-ups: SSO provides a lower barrier to entry, so new customers can sign up easily and securely, by relying on a known brand. Trust is increased, which increases conversions.
- Improves security capabilities: SSO authentication ensures that only authorized users get access to sensitive data. With Single Sign-On you can Implement password policies like Password length, complexity, restrictions on password reuse, session timeout and self-service password reset policy to strengthen security without holding up your users access.
- Efficient Collaboration: Large organizations and enterprises develop their own Single Sign-On solutions so that it is easy to share data, files, and other information across multiple applications. This makes the sharing and collaboration process faster and less expensive.

In short, implementing an SSO solution can make life easier for your users as well as benefits your business.

### What are the limitations of SSO? {#What are the limitations of SSO?}

**1. Single Password Vulnerability**: If your SSO password gets compromised, the security for all the supported apps/websites gets compromised. For example, if a user’s Google Apps password gets stolen by a hacker, the entire range of Google apps like Gmail, Google Docs, Google Drive, etc will be accessible to the hacker.

**2. Slow Process**: The authentication process using Single Sign-On is slower than traditional authentication where each app/website maintains its own database containing user data. This happens because, for every authentication attempt by the user, the application/website has to request the Single Sign-On provider for the user’s verification data.

### Is SSO Secure? {#is-sso-secure}

When single sign-on best practices are followed, a reliable SSO solution can hugely improve security. It ensures that:

- IT teams can leverage SSO to protect users with consistent security policies that adapt to their behavior while simplifying the management of usernames and passwords.
- Built-in security tools automatically identify and block malicious login attempts, improving the safety of business networks.
- Organizations can deploy security tools like [MFA](https://blog.miniorange.com/what-is-multi-factor-authentication-mfa/) in tandem with SSO, and can quickly oversee user access rights and privileges.

In addition, an SSO solution from a proven provider should give companies peace of mind through verified security protocols and service at scale.

### Why is Single Sign-On used by Organizations? {#why-is-single-sign-on-used-by-organizations}

Using **Single Sign-On services for authentication** allows organizations to delegate storage and management of user credentials to a centralized system. This prevents the hassle of managing user data and passwords.

Enterprise SSO products provide authentication to a large number of third-party applications without the need to modify the applications in any way. This turn-key feature makes it easy for organizations to migrate to SSO based authentication.

**Single Sign-On can be used in the below scenarios**

- **Authentication Using Federated Identity**: If an enterprise makes use of a third-party identity provider, federated identity (SAML) is preferred for user authentication in cloud-based as well as on-premise applications. In this case, a user attempting access to an application is redirected to an SSO based service provider which requests the identity provider for verification of the user’s identity.
- **Authentication for On-Premise Enterprise Applications**: Enterprises make use of multiple applications for various tasks. SSO can be used as a central point of authentication using a single set of login credentials for providing access to all the different enterprise applications.

**Enterprise Single Sign-On**

Enterprise Single Sign-On products basically store user credentials like username and password and automatically replay them each time a user attempts to access an enterprise application. This allows the SSO product to be used with a vast range of third party applications as the application itself does not need to be modified in any way to work with the SSO system.

**Social Single Sign-On**

Popular social networking applications like Twitter, Facebook, Google offer SSO services that allow users to log in to third-party applications with their respective social network credentials. This is very convenient for the users since they already have their information in their social media accounts and they are also logged in most of the time. But using social media SSO services also presents security risks since hackers around the world are always targeting user accounts on social networking websites.

### What is an SSO token? {#what-is-an-sso-token}

An **SSO** token is a collection of data or information that is passed from one system to another during the Single Sign On process. The data can simply be a user’s email address and information about which system is sending the token. Tokens must be digitally signed for the token receiver to verify that the token is coming from a trusted source. The certificate that is used for this digital signature is exchanged during the initial configuration process.

### Types of Single Sign-On (SSO) Protocols {#types-of-single-sign-On-sso-protocols}

**SAML**
Security Assertion Markup Language (SAML) is an open standard which contains user identity and attributes information in the form of an XML document. This XML document is digitally signed by the Identity provider and shared with the Service provider during the user authentication process.

**OAuth 2.0**
OAuth2 allows third party applications to authorize users by providing an access token. The access token prevents external applications from getting the user’s password and other data. The application can only access limited user information which is permitted by the user themselves.

**OpenID Connect**
OpenID Connect is an identity layer that operates on top of OAuth 2.0. It provides basic profile information about the end-user by specifying RESTful APIs that use JSON as a data format.

**LDAP**
LDAP (Lightweight Directory Access Protocol) is a protocol that enables anyone to locate organizations, individuals and other resources such as files and devices in a network. The network can be the Internet or a corporate intranet.

**RADIUS**
RADIUS stands for Remote Authentication Dial-In User Service. It is a client/server protocol that enables remote access servers to communicate with a central server to authenticate dial-in users and authorize their access to the requested system or service.

**WS-Federation**
WS-Federation (Web Services Federation) is an SSO protocol that is commonly used for authentication with Microsoft services like Active Directory Federation Services (ADFS) and Azure Active Directory. It defines mechanisms that are used to enable sharing of identity and account attributes, user authentication and authorization across applications.

**CAS**
The Central Authentication Service (CAS) is a single sign-on protocol for web applications. Its purpose is to allow a user to access multiple websites by using a single set of credentials only once.

### Related Articles {#related-articles}

- [Single Sign-On (SSO) Solution](https://www.miniorange.com/products/single-sign-on-sso)
- [Cloud Single Sign-On (SSO) Solution](https://www.miniorange.com/iam/cloud-sso)
- [Single Sign-On Integration](https://www.miniorange.com/iam/integrations/)
- [WordPress SAML Single Sign-On](https://plugins.miniorange.com/wordpress-single-sign-on-sso)
- [WordPress OAuth Single Sign-On](https://plugins.miniorange.com/wordpress-sso)

What is single sign-on (sso) and how it works? also learn types of sso,its benefits, and challenges for securing your apps with it.

Atlassian Server is gone but Marketplace Add-ons stays with you!

SP-Initiated vs IdP-Initiated SSO

Implementing SSO on Adobe Commerce (Magento 2)

What is G Suite IP Restriction? Enable IP Restriction for G Suite

What is Single Sign-On (SSO) and How does SSO Work?