# sso-identifier

Source: https://startwithidentity.com/glossary/sso-identifier/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

An SSO identifier, or SSO ID, is the value an identity provider sends to an application to say which user just signed in: the `NameID` in a [SAML](https://startwithidentity.com/glossary/saml/) assertion or the `sub` (subject) claim in an [OIDC](https://startwithidentity.com/glossary/oidc/) [ID token](https://startwithidentity.com/glossary/id-token/). The application uses it to find or create the matching local account. (Some vendors also use "SSO ID" for an organization's SSO connection or tenant ID; this entry covers the user identifier.)

The two standards define it differently:

| | SAML 2.0 `NameID` | OIDC `sub` |
|---|---|---|
| Defined in | [SAML Core](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf), section 8.3 | [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html), section 2 |
| Stable format | `persistent`: an opaque, pair-wise pseudonym per IdP and SP, up to 256 characters | "locally unique and never reassigned identifier within the Issuer", up to 255 ASCII characters, case-sensitive |
| Unique together with | `NameQualifier` (the IdP) | `iss` (the issuer) |
| Common shortcut | `emailAddress` or `unspecified` format | Using the `email` claim instead of `sub` |

The shortcut is where integrations break. OIDC Core section 5.7 says `sub` and `iss` together "are the only Claims that an RP can rely upon as a stable identifier", and that claims such as `email`, `phone_number` and `preferred_username` "MUST NOT be used as unique identifiers", because an issuer can reassign an email to a different person and a user's email can change. Keying accounts on email causes duplicate accounts after a name change, and in multi-tenant apps it can let one tenant's user sign in as another's.

The practical rule: store the issuer and subject pair as the account key, treat email as a mutable attribute, and use [SCIM](https://startwithidentity.com/glossary/scim/) or a just-in-time update to keep attributes current.

See also: [SSO](https://startwithidentity.com/glossary/sso/), [claims](https://startwithidentity.com/glossary/claims/), [SAML 2.0](https://startwithidentity.com/standards/saml-2-0/), [OpenID Connect](https://startwithidentity.com/standards/openid-connect/), [cross-tenant token confusion](https://startwithidentity.com/techniques/cross-tenant-token-confusion/), [implementing SSO](https://startwithidentity.com/guides/authentication/complete-guide-implementing-sso/)