Identity & Access Management — Federated SSO (2D)

One password vault vs. one login for everything: compare per-app passwords with SAML / OIDC single sign-on.

Access model

Each app (Email, CRM, HR) keeps its own password. Users reuse or forget them — and IT must disable each account separately.

Actions

Live stats

Passwords the user must remember

Credential entries to reach 3 apps

Offboarding steps for IT

3 separate tickets

Exposure window after termination

Hours–days

Legend

User Identity Provider (IdP) Email · CRM · HR Password packet SAML / OIDC token Revoked access

Top-down flow diagram. Switch modes, then try Login attempt and Deprovision user to see the offboarding gap.