Single sign-on One work account, verified once, accepted by many apps.
Short answer. Single sign-on (SSO) lets a person sign in once with one work account and use many applications without separate passwords. NIST defines it as an authentication process in which one account and its authenticators are used to access multiple applications, generally through a federation protocol. Two widely used protocols are OpenID Connect, an identity layer on OAuth 2.0, and SAML 2.0. The office’s identity provider, such as Microsoft Entra ID or Google Workspace, verifies the person and tells each app who they are. That means fewer passwords, one place to switch off a leaver and one record of sign-ins. For an AI system, it ties each question to a named person.
01
How a sign-in works
When someone opens an app that uses SSO, the app does not ask for a password. It sends them to the identity provider. The identity provider checks their credentials, including multi-factor authentication if required, and sends back a signed statement that this person has authenticated: a SAML assertion or an OpenID Connect ID token. The app trusts that statement, starts a session and reads the person’s name and groups from it. Microsoft’s documentation puts the result simply: apps no longer manage separate usernames and passwords.
02
SAML or OpenID Connect
Protocol
What it is
What setting it up looks like
SAML 2.0
An OASIS framework for exchanging security information between online business partners. Multi-domain web single sign-on is arguably its most important use
In Google Workspace you add a custom SAML app and give the service the identity provider’s metadata, or its SSO URL, entity ID and certificate
OpenID Connect
An identity layer on top of OAuth 2.0 that lets a client verify the user’s identity from the authentication done by an authorisation server
The app receives an ID token carrying claims about the sign-in
03
What SSO gives you, and what it does not
Gives: fewer passwords to steal. The UK NCSC says SSO can limit the number of passwords in use and reduce the chance of them being stolen.
Gives: one switch-off. Disable the account at the identity provider and every connected app loses the person.
Gives: one place to enforce multi-factor authentication.
Does not give: permissions inside the app. SSO says who you are, and roles say what you may do. See role-based access control.
Does not give: protection if the work account is stolen. A compromised identity provider account opens every connected app, so protect it with multi-factor authentication.
04
Questions for an AI vendor
Which protocols are supported today, SAML 2.0, OpenID Connect or both, and which are not built yet?
Can groups at the identity provider map to roles in the AI system?
What happens when the identity provider is unreachable? If it lives in the cloud and the internet is down, can staff still sign in, or is there a local fallback account?
Does signing out at the identity provider end the AI session?
Is each request logged against the named person from the identity provider?
05
Where ANVE stands
ANVE is built for many named users, so each answer, action and model call can be tied to a person. Its security page (/security) says single sign-on is not on ANVE yet, and that roles today are administrator and user. Ask which sign-in protocols will be supported and when, and get the answer in writing before a paid pilot.
06
Questions people ask
Is SSO the same as a password manager?
No. A password manager stores many passwords for you. SSO removes the need for separate passwords by letting one trusted account vouch for you.
Is SSO the same as multi-factor authentication?
No. SSO decides how many times you sign in. Multi-factor authentication decides how strongly you prove who you are. They work best together.
Can an offline AI box use SSO?
Only if it can reach your identity provider. If that provider is in the cloud, an air-gapped box cannot, so ask about a local directory or fallback accounts.
What is an identity provider?
The system that holds staff accounts and signs people in, such as Microsoft Entra ID or Google Workspace. Their documentation describes each acting as the identity provider for other apps.
Does ANVE support single sign-on?
Not yet. ANVE’s published security page lists single sign-on, teams and finer roles as not built yet. Today the roles are administrator and user.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
