Design single sign-on (SSO)
PremiumSecurity systemMedium
- SAML 2.0
- OpenID connect
- PKCE
Quick answer
This security system interview question asks you to design single sign-on (SSO). Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design single sign-on (SSO) for a company: one identity provider that lets 45,000 people sign in once and open 250 apps, like the workforce login portals large companies use. The hard parts are checking every SAML and OIDC message exactly and cutting a leaver off everywhere within minutes.
The identity provider (IdP) owns the login page, MFA and the user's session. Apps are service providers (SPs): 150 older apps speak SAML 2.0 and 100 newer ones speak OpenID Connect (OIDC). Today each app has its own password, and IT disables a leaver's accounts by hand over several days.
What must the system do?
- Sign in once: A user signs in at the IdP with a password and MFA, then opens any assigned app without signing in again during the session.
- Two protocols: Support SAML 2.0 (SP-initiated and IdP-initiated) and the OIDC authorization code flow with PKCE for web, mobile and single-page apps.
How well must it do it?
- Token safety: Every assertion and ID token is signed, short-lived and bound to one app (audience) and one login attempt.
- Availability: 99.99% for login and token endpoints; while the IdP is down nobody can open a new app session.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- SAML 2.0
- OpenID connect
- PKCE
- JWT
- SCIM
- MFA
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design single sign-on (SSO) and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team