Design Single Sign-On - System Design | WinJob

Problem Statement & Enterprise SSO Context

Interviewers at Okta, Auth0, and Azure AD expect you to own the identity front door: one authenticated session that fans out SAML assertions and OIDC tokens to hundreds of SaaS and internal apps without re-prompting passwords.

Key points

SSO is the control plane for login UX and security policy
Protocols differ—SAML for legacy SaaS, OIDC for modern APIs
Tenant isolation is non-negotiable at enterprise scale

Deep dive

Section 1 focuses on federation hub for a multi-tenant enterprise SSO portal. Tie recommendations to measurable SLOs (login p99 800ms, sign p99 120ms, logout fanout 5s) and concrete stores (Redis session keys, Postgres app registry, HSM signing partition). State failure modes: upstream IdP timeout, stale SP metadata, replay insert race, or JWKS drift during rotation.

javaOne Dark Pro

1 public final class SsoTenantContext {
2   private final String tenantId;
3   private final String idpConnectionId;
4   public String shardKey() { return tenantId + ":" + idpConnectionId; }
5 }

pythonOne Dark Pro

1 @dataclass(frozen=True)
2 class SsoTenantContext:
3     tenant_id: str
4     idp_connection_id: str

typescriptOne Dark Pro

1 interface SsoTenantContext {
2   tenantId: string;
3   idpConnectionId: string;
4 }
5  
6 export function shardKey(c: SsoTenantContext): string {
7   return `${c.tenantId}:${c.idpConnectionId}`;
8 }

Operational notes

Note 1.1 (federation hub): tenant shard for Problem Statement & Enterprise SSO Context.
Note 1.2 (federation hub): SAML signature for Problem Statement & Enterprise SSO Context.
Note 1.3 (federation hub): OIDC PKCE for Problem Statement & Enterprise SSO Context.
Note 1.4 (federation hub): replay cache for Problem Statement & Enterprise SSO Context.
Note 1.5 (federation hub): HSM rotation for Problem Statement & Enterprise SSO Context.
Note 1.6 (federation hub): upstream IdP breaker for Problem Statement & Enterprise SSO Context.
Note 1.7 (federation hub): logout fanout for Problem Statement & Enterprise SSO Context.
Note 1.8 (federation hub): JWKS overlap for Problem Statement & Enterprise SSO Context.
Note 1.9 (federation hub): assertion TTL for Problem Statement & Enterprise SSO Context.
Note 1.10 (federation hub): SIEM webhook for Problem Statement & Enterprise SSO Context.
Note 1.11 (federation hub): residency cell for Problem Statement & Enterprise SSO Context.
Note 1.12 (federation hub): chaos HSM failover for Problem Statement & Enterprise SSO Context.

When pressed on federation hub, cite estimation numbers, name the mitigated failure mode, and point to the diagram edge that enforces the invariant.

Why interviewers care

Single Sign-On interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement & Enterprise SSO Context that proves you understand real outages, not happy-path diagrams.

Key Highlights

•SSO is the control plane for login UX and security policy
•Protocols differ—SAML for legacy SaaS, OIDC for modern APIs
•Tenant isolation is non-negotiable at enterprise scale

1	public final class SsoTenantContext {
2	private final String tenantId;
3	private final String idpConnectionId;
4	public String shardKey() { return tenantId + ":" + idpConnectionId; }
5	}

1	@dataclass(frozen=True)
2	class SsoTenantContext:
3	tenant_id: str
4	idp_connection_id: str

1	interface SsoTenantContext {
2	tenantId: string;
3	idpConnectionId: string;
4	}
5
6	export function shardKey(c: SsoTenantContext): string {
7	return `${c.tenantId}:${c.idpConnectionId}`;
8	}