Single Sign-On Provider

Description

The SSO Provider (Single Sign-On Provider) is a functional entity defined in 3GPP specifications 22.101 and 22.895 that provides Single Sign-On services within the 3GPP ecosystem. Single Sign-On is a property of access control where a user logs in once and gains access to multiple independent software systems without being prompted to log in again for each of them. In the 3GPP context, the SSO Provider enables a user to authenticate to an Identity Provider (IdP) and thereby have their identity asserted to a Data Application Provider (DAP). The SSO Provider is the entity that facilitates this authentication and assertion process, and in the 3GPP SSO Service, the SSO Provider is the 3GPP Operator.

The architecture of the 3GPP SSO service involves several key actors. The user (or UE) interacts with a data application provided by a DAP. The DAP relies on the SSO Provider to authenticate the user and assert the user's identity. The SSO Provider, in turn, interacts with an Identity Provider (IdP) that actually performs the authentication. The SSO Provider acts as a trusted intermediary that receives identity assertions from the IdP and provides authentication of users to Application Service Providers. Each data application, whether provided by different DAPs or the same DAP, may have its own policy regarding authentication, meaning that the SSO Provider must be able to handle varying authentication requirements and policies.

The operation of the SSO Provider involves a sequence of steps. When a user attempts to access a data application, the DAP redirects the user to the SSO Provider for authentication. The SSO Provider then redirects the user to the IdP, where the user authenticates (e.g., using credentials, certificates, or other mechanisms). Upon successful authentication, the IdP generates an identity assertion (such as a SAML assertion or an OpenID Connect token) and sends it to the SSO Provider. The SSO Provider validates the assertion and then provides its own authentication assertion to the DAP, confirming the user's identity. The DAP can then grant access to the user based on its own authorization policies. This process is transparent to the user, who experiences a single login that grants access to multiple applications.

A critical aspect of the SSO Provider is its role in the 3GPP SSO Service, where the 3GPP Operator acts as the SSO Provider. This means that the mobile network operator manages the SSO infrastructure, leveraging the operator's existing subscriber authentication infrastructure (such as the UICC/USIM) to provide strong authentication. This integration allows the operator to offer value-added services to enterprises and application providers, positioning the operator as a trusted identity broker. The SSO Provider must support standard protocols such as SAML 2.0, OpenID Connect, or OAuth 2.0 to interoperate with various IdPs and DAPs.

Security is paramount for the SSO Provider. It must ensure the confidentiality and integrity of authentication assertions, protect against replay attacks, and manage trust relationships with IdPs and DAPs. The SSO Provider also plays a role in privacy, as it must handle user identity information in compliance with regulatory requirements. In 3GPP Release 11, the definition was initially 'A party receiving identity assertions from an Identity Provider and providing authentication of users to Application Service Providers.' In Release 12, the wording was changed to the current definition, which more precisely describes the SSO Provider as an entity that provides SSO Service and enables user authentication to an IdP with identity assertion to a DAP. This refinement clarified the SSO Provider's role as the service provider rather than just a party receiving assertions.

Purpose & Motivation

The SSO Provider exists to solve the problem of fragmented authentication across multiple applications and services in mobile networks. Without Single Sign-On, users would need to maintain separate credentials for each application, leading to password fatigue, increased helpdesk costs, and weaker security as users reuse passwords. For mobile operators, providing an SSO service creates new business opportunities by leveraging their trusted position as the subscriber identity provider. The SSO Provider enables operators to become identity brokers, offering enterprises and application providers a secure and convenient way to authenticate users.

The motivation for defining the SSO Provider in 3GPP Release 11 was to standardise how operators can offer SSO services within the 3GPP ecosystem. Prior to this, SSO solutions were proprietary and not integrated with mobile network authentication. By defining the SSO Provider role, 3GPP enabled interoperability between mobile operators, identity providers, and application service providers. This is particularly important for enterprise applications, where employees need seamless access to multiple services while maintaining strong security.

The SSO Provider also addresses the need for consistent authentication policies across different data applications. Each DAP may have its own policy, and the SSO Provider must be able to enforce these policies while providing a unified user experience. This flexibility is essential for supporting a wide range of services, from consumer applications to mission-critical enterprise tools. The evolution of the definition in Release 12 reflects a deeper understanding of the SSO Provider's role, moving from a passive receiver of assertions to an active service provider that manages the entire SSO process.