# Single Sign-On (SSO)

> Source: https://netray.co/glossary/single-sign-on
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Glossary

## Short answer

Single sign-on lets users authenticate once with a central identity provider and reach the ERP and other apps without separate passwords. It uses standards such as SAML 2.0 or OpenID Connect.

## Aliases

- SSO
- SAML SSO
- OIDC login
- federated login

## Category

integration

## Full Definition

With single sign-on (SSO), the ERP trusts an external identity provider (IdP) such as Microsoft Entra ID, Okta or Active Directory Federation Services to confirm who the user is. The user signs in once, the IdP issues a signed assertion (SAML 2.0) or token (OpenID Connect), and the ERP accepts it. The ERP no longer stores or checks the user's password.

Support varies by product. NetSuite supports SAML single sign-on for the UI. Infor CloudSuite products authenticate through Infor Ming.le and Infor OS identity services, which can federate to a corporate IdP. On-premises SyteLine and LN deployments commonly use Windows or LDAP authentication, and may be fronted by a gateway for modern federation. Authentication proves identity only; authorization still comes from ERP roles.

SSO is the practical place to enforce multi-factor authentication and conditional access, because the IdP can require MFA, block risky sign-ins and apply device rules once for every connected app. It also fixes offboarding: disabling the user in the IdP removes access everywhere, provided the ERP has no local fallback passwords left active.

Integrations and APIs need separate thought. Service accounts, scheduled jobs, EDI and AI agents do not do interactive logins, so they use tokens or client credentials with narrow scopes, rotated on a schedule, and monitored like any privileged account.

## Why It Matters

- It removes password reuse and reset tickets, and gives one place to enforce MFA and conditional access.
- Offboarding becomes reliable because a single disabled identity cuts off the ERP and connected tools.
- Local break-glass accounts left outside SSO are a common audit finding and a real attack path.
- It is a prerequisite for most customer security questionnaires and cyber insurance renewals.

## In Practice

A plant with an on-prem ERP adds SAML federation through its Entra ID tenant, requires MFA for remote access and keeps two documented break-glass admin accounts with long, vaulted passwords. Password reset tickets for the ERP drop to near zero, and an exiting employee is disabled in one place. Integration service accounts stay on rotated tokens and are listed in the quarterly access review.

## Faq

### What is the difference between SAML and OpenID Connect?

**Answer:** Both let an identity provider vouch for a user. SAML is an older XML-based standard common in enterprise apps; OpenID Connect is a newer JSON and token-based layer on OAuth 2.0 favored for modern web and mobile apps.

### Does SSO replace ERP roles and permissions?

**Answer:** No. SSO handles authentication, proving who the user is. What they can do inside the ERP is still decided by the ERP's roles and permissions.

### Can an on-prem ERP use SSO?

**Answer:** Often yes, through Windows or LDAP authentication, a federation gateway or a reverse proxy, depending on the product and version. Check the vendor's supported methods before designing it.

## Search terms

single sign-on ERP, SSO for NetSuite, SAML ERP login, OIDC ERP, Entra ID ERP SSO, Okta ERP integration, ERP MFA, what is SSO

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json