tl;dr: SSO seems like a big risk to me, from being a single point of failure, and I think we could use signed certificates instead.<p>So, I may be completely uninformed here, but I don't see SSO as a good thing. I understand the advantages it has, but it gives an outside party the ability to restrict what your employees can do, should it so decide.<p>For example, we hear of Google banning people from accounts all of the time. Perhaps your company uses Google's SSO for all of its vendor accounts. If Google decided to ban the admin accounts of your SSO, all of your employees are now unable to work. Perhaps that happens during an outage caused by a DDoS (maybe the DDoS effects were why Google banned you). At that point, your employees can do <i>nothing</i> to bring your systems back online. If they can't, chances are you will go out of business if your revenue depends on your systems being online.<p>This seems like an <i>enormous</i> risk.<p>I'm no cryptographer, but here's my design of something to replace SSO: instead of each vendor supporting SSO, they support "certificate checks." When a user, your employee, logs on, the vendor contacts a pre-determined server, preferably controlled by you directly, for a certificate for the employee. Your server can either return one, cryptographically signed by your master key, of course, or refuse to return one.<p>If it returns one, and the signature is valid (maybe they expire after certain amount of time), then the vendor will let your employee on. If not, the vendor refuses access.<p>I believe that this system has the upside of SSO that access to all vendors for a particular employee can be revoked at any time by simply telling the server that <i>you</i> control to not return a certificate, but it also does not have the downside that centralized authentication for your business is controlled by someone else.<p>Of course, this also means that the employee cannot use one username and password for access to everything (unless they do it manually, of course; are you training your employees to not do that?). However, I think that that is actually an advantage because that single account sign on becomes a single point of failure. If that account is compromised, perhaps by phishing, the attacker now has access to all of the vendor accounts for that employee. Having separate username/password pairs for all of the accounts is much better (you are having your employees use password managers, right?).<p>Am I right? If not, why? What am I missing?