Security Tokens:
  SAML Token:
    - XML-based
    - Enterprise focused
    - Rich attribute support
    
  OAuth Token:
    - JSON-based
    - Web/mobile friendly
    - Limited scope
    
  JWT Token:
    - Self-contained
    - Stateless
    - Compact format

<saml:Assertion>
  <saml:Subject>
    <saml:NameID>user@company.com</saml:NameID>
  </saml:Subject>
  <saml:AuthnStatement>
    <saml:AuthnContext>
      <saml:AuthnContextClassRef>
        urn:oasis:names:tc:SAML:2.0:ac:classes:Password
      </saml:AuthnContextClassRef>
    </saml:AuthnContext>
  </saml:AuthnStatement>
  <saml:AttributeStatement>
    <saml:Attribute Name="Department">
      <saml:AttributeValue>Engineering</saml:AttributeValue>
    </saml:Attribute>
  </saml:AttributeStatement>
</saml:Assertion>

SAML Configuration:
  Entity ID: https://company.com/sso
  SSO URL: https://idp.company.com/sso
  Certificate: -----BEGIN CERTIFICATE-----
  Attribute Mapping:
    - Email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
    - Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
    - Role: http://schemas.microsoft.com/ws/2008/06/identity/claims/role

Grant Types:
  Authorization Code:
    - Most secure
    - For web applications
    - Requires client secret
    
  Implicit:
    - For public clients
    - Browser-based apps
    - No client secret
    
  Client Credentials:
    - Service-to-service
    - No user involvement
    - Backend applications
    
  Resource Owner Password:
    - Legacy applications
    - Direct username/password
    - Not recommended

// ID Token (JWT)
{
  "header": {
    "alg": "RS256",
    "typ": "JWT"
  },
  "payload": {
    "iss": "https://accounts.company.com",
    "sub": "1234567890",
    "aud": "client_id_123",
    "exp": 1234567890,
    "iat": 1234567890,
    "email": "user@company.com",
    "name": "John Doe"
  }
}

{
  "client_id": "your-client-id",
  "client_secret": "your-client-secret",
  "issuer": "https://accounts.company.com",
  "authorization_endpoint": "https://accounts.company.com/auth",
  "token_endpoint": "https://accounts.company.com/token",
  "userinfo_endpoint": "https://accounts.company.com/userinfo"
}

# Add relying party trust
Add-ADFSRelyingPartyTrust `
  -Name "Company App" `
  -MetadataUrl "https://app.company.com/metadata" `
  -IssuanceTransformRules @'
    c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]
    => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", Value = c.Value);
'@

Azure AD Features:
  - Conditional Access
  - Multi-Factor Authentication
  - Device Compliance
  - Risk-Based Authentication
  - Application Gallery (5000+ apps)

Okta Capabilities:
  - Universal Directory
  - Adaptive MFA
  - Lifecycle Management
  - API Access Management
  - Advanced Server Access

Google Identity:
  - G Suite Integration
  - Cloud Identity
  - Context Aware Access
  - Security Keys
  - Mobile Device Management

PingIdentity Features:
  - PingOne Cloud Platform
  - PingFederate
  - PingAccess
  - PingDirectory
  - API Intelligence

SSO Security Metrics:
  - Failed authentication attempts
  - Unusual login patterns
  - Device compliance status
  - Geographic access patterns
  - Application usage patterns

Risk Mitigation:
  High Availability:
    - Redundant SSO infrastructure
    - Load balancing
    - Disaster recovery plans
    
  Token Security:
    - Short token lifetimes
    - Token encryption
    - Secure transmission (HTTPS)
    
  Session Protection:
    - Session timeout policies
    - Concurrent session limits
    - Device binding
    
  Monitoring:
    - Real-time threat detection
    - Anomaly detection
    - Incident response procedures

SSO Configuration:
  Certificate Management:
    - Key rotation schedule
    - Certificate validation
    - Trust store management
    
  Network Security:
    - HTTPS enforcement
    - Network segmentation
    - Firewall rules
    
  Application Integration:
    - Standard protocols (SAML/OIDC)
    - Attribute mapping
    - Error handling

SSO Monitoring:
  Performance Metrics:
    - Authentication response time
    - Token validation latency
    - System availability
    
  Security Metrics:
    - Failed authentication rate
    - Anomalous login patterns
    - Token compromise indicators
    
  User Experience:
    - Login success rate
    - Help desk tickets
    - User satisfaction scores

// Express.js with Passport SAML
const passport = require('passport');
const SamlStrategy = require('passport-saml').Strategy;

passport.use(new SamlStrategy({
    path: '/login/callback',
    entryPoint: 'https://idp.company.com/sso',
    issuer: 'https://app.company.com',
    cert: process.env.SAML_CERT,
    privateCert: process.env.SAML_PRIVATE_KEY
  },
  function(profile, done) {
    // User profile processing
    const user = {
      id: profile.nameID,
      email: profile.email,
      name: profile.displayName,
      role: profile.role
    };
    return done(null, user);
  }
));

// Routes
app.get('/login', passport.authenticate('saml'));
app.post('/login/callback', passport.authenticate('saml'), 
  (req, res) => {
    res.redirect('/dashboard');
  }
);

# Flask with OAuth
from authlib.integrations.flask_client import OAuth

oauth = OAuth(app)
oauth.register(
    name='company_sso',
    client_id='your-client-id',
    client_secret='your-client-secret',
    server_metadata_url='https://sso.company.com/.well-known/openid_configuration',
    client_kwargs={
        'scope': 'openid email profile'
    }
)

@app.route('/login')
def login():
    return oauth.company_sso.authorize_redirect(
        redirect_uri=url_for('callback', _external=True)
    )

@app.route('/callback')
def callback():
    token = oauth.company_sso.authorize_access_token()
    user = oauth.company_sso.parse_id_token(token)
    session['user'] = user
    return redirect('/dashboard')

import AuthenticationServices

class SSOManager: NSObject {
    func authenticateWithSSO() {
        let authURL = URL(string: "https://sso.company.com/auth")!
        let callbackURL = URL(string: "companyapp://callback")!
        
        let session = ASWebAuthenticationSession(
            url: authURL,
            callbackURLScheme: "companyapp"
        ) { callbackURL, error in
            if let callbackURL = callbackURL {
                self.handleCallback(url: callbackURL)
            }
        }
        
        session.presentationContextProvider = self
        session.start()
    }
    
    private func handleCallback(url: URL) {
        // Extract authorization code
        // Exchange for tokens
        // Store securely in Keychain
    }
}

// Using AppAuth library
public class SSOActivity extends AppCompatActivity {
    private AuthorizationService authService;
    
    private void performSSO() {
        AuthorizationServiceConfiguration config = 
            new AuthorizationServiceConfiguration(
                Uri.parse("https://sso.company.com/auth"),
                Uri.parse("https://sso.company.com/token")
            );
        
        AuthorizationRequest request = 
            new AuthorizationRequest.Builder(
                config,
                "client-id",
                ResponseTypeValues.CODE,
                Uri.parse("com.company.app://callback")
            )
            .setScope("openid email profile")
            .build();
        
        Intent intent = authService.getAuthorizationRequestIntent(request);
        startActivityForResult(intent, AUTH_REQUEST_CODE);
    }
}