Definition
Single Sign-On is a session and authentication scheme in which a user logs in once to a central identity provider, and is then granted access to multiple services without entering credentials again for each. Common SSO standards are SAML 2.0 (mature, widely deployed in enterprise), OpenID Connect (modern, OAuth-based, used in cloud apps), and Kerberos (the on-premises Microsoft staple).
SSO and VPNs
Most enterprise VPNs integrate with SSO. Instead of issuing a separate VPN username and password, the gateway redirects the user to the corporate identity provider (Okta, Azure AD, Google Workspace, Ping Identity), which authenticates them and returns an assertion the gateway can verify. Benefits include centralized account management, consistent multi-factor enforcement, and rapid offboarding when an employee leaves — disable the central account and they are immediately locked out of every system, including the VPN.
Trade-Offs
SSO concentrates risk: a compromised SSO account is a compromised everything. This is why MFA on SSO is non-negotiable, and why phishing-resistant factors (FIDO2 hardware keys) are preferred over SMS or TOTP for high-value accounts. SSO is also part of the move toward Zero Trust, where the SSO assertion is reused to authorize each individual application access request rather than just an initial VPN login.