Do you Use Single Sign-on?
By Poonam Basliyal
Feb 6, 2012 - Imagine having one password for access to all of your used web sites. Imagine no longer filling out forms to sign-up for a new portal and not having to remember tons of usernames and passwords. And all of your mobile apps automatically logon and know it is you. You may be doing this already now. If not, you may want to read on.
Several years ago, Facebook, Twitter, Google, Linked In and other ompanies have allowed access to their epositories of usernames and user data. Most ave adopted a standard called OAuth for authenticating against these atabases. This specification was written by a roup of developers from Google, who introduced version 1.0 in 2007.
Several years ago, Facebook, Twitter, Google, Linked In and other companies have allowed access to their repositories of usernames and user data. Most have adopted a standard called OAuth for authenticating against these databases. This specification was written by a group of developers from Google, who introduced version 1.0 in 2007..
How it Works
From the user point-of-view, they will click on an icon or link from a web site. The authentication will occur automatically, assuming the user is logged into their account (Facebook, Twitter, etc.) already. A "request for permission" page will appear to allow the user to approve the information being accessed/shared. See two examples below:
Once authenticated, web site can access and change (if allowed) the fields kept in the user repositories. Keep in mind that each site may have different fields of information:
Which Service is Best?
The service selection depends on your needs and it usually makes sense to allow more than one. These are estimates of users for the most popular SSO sites.
Twitter is prevalent with news web sites, while Facebook is more common with entertainment and travel sites. Linked In is very popular with business users and Google with users of Gmail, Google+ and the Google App store.
In June 2011, Apple introduced Twitter SSO Integration with iOS 5, which will allow an easy interface for iTunes apps to use SSO. Many feel that this gives Twitter and an advantage in the SSO technology.
Facebook has integration with Windows phone and there is a new program called Facebook Credits which provides a payment system for users. Facebook also allows you to track your customer activity while using you’re the Facebook id at your site.
Google leverages their Marketplace and App store, as well as numerous other services like Gmail where users already have authentication ids. With the Google EasyConnect for Google Apps, Android’s have built-in support for SSO.
Your Facebook, Twitter, Google, LinkedIn information is being collected and some of it will now be available to web sites that integrate via SSO. The OAuth implementation provides an opportunity for users to allow or deny information being obtained, but the kind of information queried is not always provided and some information will be required for logon to web sites.
SSO is the way of the future and like corporate LDAPs, the quantity of information about a user will only increase. The end result will be an improved user experience on the web. Today, many web sites have their own logon, but in the future it is likely that you can pick and choose the logon service that you will use when logging onto any web site. It is certainly possible that Twitter and Facebook could evolve to the point where they are known for their user repositories and people forget their humble beginnings as social media web sites.