Skip to content
Connect2id

Single sign-on

One flexible login for all your users and applications

Providing Single Sign-On (SSO) to applications is a key aspect of the Connect2id server. The enterprise earns the benefits of a centralised login while being able to establish segmented login channels and experiences, depending on the type of user, device and application.

  • Highly-available login for web, mobile and desktop applications.

  • Provide SSO for on-premise, cloud-based and third-party SaaS applications.

  • Authentication and consent flows tailored to the security and verification requirements of each class of users, whether employees, contractors, partners or customers / consumers.

ID token based integration

The ID token provides a unified object for signing users into applications (relying parties). It is compact, JSON-based and URL-safe, and can be protected by a range of cryptographic algorithms, such as HMAC, RSA and EC signatures. ID tokens are also easier to consume, compared to SAML.

{
  "sub"       : "alice",
  "iss"       : "https://c2id.com",
  "aud"       : "app-123",
  "auth_time" : 1311280969,
  "acr"       : "https://loa.c2id.com/high",
  "iat"       : 1311280970,
  "exp"       : 1311281970
}

Logout

Applications can subscribe to be notified of user logout via standard OpenID Connect front and back-channel mechanisms. Application-initiated logout at the Connect2id server is also supported.

Managing an ocean of sessions

The built-in session store of the Connect2id server has been optimised over the years to handle hundreds of millions of concurrent sessions with low latency and presents a comprehensive web API to manage and monitor them.

  • Users can have multiple concurrent login web and device sessions, with clear isolation between them.

  • Each user session can be established at a specific authentication level (LoA) to match the application’s security requirements. For instance, a financial or sysadmin application could require a session with strong two-factor authentication, while a federated social login could be sufficient for less sensitive applications.

  • Selected session attributes can be automatically fed into the issued ID tokens.

  • The web API provides calls to check who is online and collect useful metrics.