Skip to main content

authentication methods like SSO, MFA, and OAuth2.

SSO, MFA, and OAuth2 are distinct authentication and authorization methods: SSO lets users log in once to access multiple services, MFA adds extra security layers by requiring multiple verification factors, and OAuth2 is an authorization framework that lets third-party apps access data on behalf of a user without needing their password. 

Single Sign-On (SSO)
  • What it is: A system that allows users to log in with a single set of credentials to access multiple applications and services.
  • How it works: An identity provider (IdP) authenticates the user once. This authentication is then securely shared with other applications (service providers), allowing access without a new login.
  • Examples: Logging into Google and gaining access to Gmail, Drive, and Calendar with a single login. 

Multi-Factor Authentication (MFA)
  • What it is: A security process that requires users to provide two or more verification factors to gain access to a resource.
  • How it works: It combines different types of "factors" to verify identity, such as:
    • Knowledge: Something the user knows (e.g., a password).
    • Possession: Something the user has (e.g., a one-time code from a mobile app or a security key).
    • Inherence: Something the user is (e.g., a fingerprint or facial scan).
  • Benefit: Significantly enhances security beyond a single password by making it harder for unauthorized individuals to gain access even if they have a password. 

OAuth 2.0
  • What it is: An open-standard authorization framework that grants a third-party application limited access to a user's data on a resource server without sharing the user's credentials.
  • How it works: Instead of sharing a password, the user grants permission for the third-party app to access certain data. The resource server then issues short-lived access tokens to the app, allowing it to perform specific actions.
  • Example: When you "Log in with Google," OAuth 2.0 is used to authorize the app to access specific information from your Google account without you giving the app your Google password.
  • Note: OAuth 2.0 is for authorization, not direct authentication. For a complete authentication process, it is often used with an identity layer like OpenID Connect (OIDC), which is built on top of OAuth 2.0
Back to top