SSO concentrates convenience and consequence
Single sign-on means one login opens everything, which is both the benefit and the risk.
It genuinely improves security in most organisations: one account to protect properly, one place to enforce MFA, one place to switch off when somebody leaves. It also means compromising that one account compromises everything at once, and that an outage there stops all work rather than some. Concentrating is usually the right trade. It is still a trade.
More on OAuth and federation
- OAuth consent is not proof of identityThe ticket, not the person
- Token scope defines capabilityIt only presses three
- Bearer tokens behave like cashWhoever picks it up
- Federation shifts where trust livesThe decision moved house
- Redirect URI validation protects token deliveryPosted only where it fits
- Token audience prevents universal reuseA ticket for this gate only
