What Is Single Sign-On (SSO)?
Also known as: SSO, SAML SSO, OIDC login, federated login
Definition
Single sign-on lets users authenticate once with a central identity provider and reach the ERP and other apps without separate passwords. It uses standards such as SAML 2.0 or OpenID Connect.
Single Sign-On (SSO) Explained
With single sign-on (SSO), the ERP trusts an external identity provider (IdP) such as Microsoft Entra ID, Okta or Active Directory Federation Services to confirm who the user is. The user signs in once, the IdP issues a signed assertion (SAML 2.0) or token (OpenID Connect), and the ERP accepts it. The ERP no longer stores or checks the user's password.
Support varies by product. NetSuite supports SAML single sign-on for the UI. Infor CloudSuite products authenticate through Infor Ming.le and Infor OS identity services, which can federate to a corporate IdP. On-premises SyteLine and LN deployments commonly use Windows or LDAP authentication, and may be fronted by a gateway for modern federation. Authentication proves identity only; authorization still comes from ERP roles.
SSO is the practical place to enforce multi-factor authentication and conditional access, because the IdP can require MFA, block risky sign-ins and apply device rules once for every connected app. It also fixes offboarding: disabling the user in the IdP removes access everywhere, provided the ERP has no local fallback passwords left active.
Integrations and APIs need separate thought. Service accounts, scheduled jobs, EDI and AI agents do not do interactive logins, so they use tokens or client credentials with narrow scopes, rotated on a schedule, and monitored like any privileged account.
Why It Matters
- It removes password reuse and reset tickets, and gives one place to enforce MFA and conditional access.
- Offboarding becomes reliable because a single disabled identity cuts off the ERP and connected tools.
- Local break-glass accounts left outside SSO are a common audit finding and a real attack path.
- It is a prerequisite for most customer security questionnaires and cyber insurance renewals.
In Practice
A plant with an on-prem ERP adds SAML federation through its Entra ID tenant, requires MFA for remote access and keeps two documented break-glass admin accounts with long, vaulted passwords. Password reset tickets for the ERP drop to near zero, and an exiting employee is disabled in one place. Integration service accounts stay on rotated tokens and are listed in the quarterly access review.
Frequently Asked Questions
What is the difference between SAML and OpenID Connect?
Both let an identity provider vouch for a user. SAML is an older XML-based standard common in enterprise apps; OpenID Connect is a newer JSON and token-based layer on OAuth 2.0 favored for modern web and mobile apps.
Does SSO replace ERP roles and permissions?
No. SSO handles authentication, proving who the user is. What they can do inside the ERP is still decided by the ERP's roles and permissions.
Can an on-prem ERP use SSO?
Often yes, through Windows or LDAP authentication, a federation gateway or a reverse proxy, depending on the product and version. Check the vendor's supported methods before designing it.
Related Terms
Role-Based Access Control (RBAC)
Role-based access control grants ERP permissions to roles that match job functions, then assigns users to roles, instead of setting permissions user by user. It makes access consistent, reviewable and easier to remove.
API (Application Programming Interface)
An API (Application Programming Interface) is a defined contract that lets one software system request data or trigger functions in another, specifying the available operations, the structure of requests and responses, and the rules for authentication and error handling.
Audit Trail
An audit trail is a secure, time-stamped record of who created, changed, approved or deleted data in a system, including old and new values. In an ERP it supports financial, quality and security audits.
Zero Trust Architecture
Zero trust is a security model that assumes no user, device or network location is trusted by default. Every request is verified for identity, device health and authorization, and access is limited to the minimum needed.
Middleware
Middleware is software that sits between applications and handles the communication, transformation, routing, and reliability concerns of moving data between them, so that the applications themselves do not need to know about each other directly.
Go Deeper
ERP Security Posture Checklist
Work through 30 concrete security controls across access, patching, network, data protection, and monitoring, with the highest-risk items flagged.
Free ToolOn-Prem AI Security Hardening Checklist
A practical control checklist for securing self-hosted language models, covering model provenance, network isolation, data governance, host hardening, and audit readiness.
ERP Security Best Practices Guide
Implement comprehensive ERP security best practices covering access control, encryption, monitoring, and compliance aligned with NIST CSF and CIS Controls frameworks.
CloudSuite Industrial Cloud Security Architecture
Understand CloudSuite Industrial cloud security architecture including identity management, encryption, network security, and compliance for CSI deployments.
ERP User Access Review Process Guide
Establish a structured ERP user access review process with review cycles, certification workflows, exception handling, and audit evidence for SOX and ISO compliance.
Working with Single Sign-On (SSO) in a live environment? Our engineers do this every day - and our AI agents automate most of it.