SSO Identifier (SSO ID)

An SSO identifier, or SSO ID, is the value an identity provider sends to an application to say which user just signed in: the NameID in a SAML assertion or the sub (subject) claim in an OIDC ID token. The application uses it to find or create the matching local account. (Some vendors also use "SSO ID" for an organization's SSO connection or tenant ID; this entry covers the user identifier.)

The two standards define it differently:

The shortcut is where integrations break. OIDC Core section 5.7 says sub and iss together "are the only Claims that an RP can rely upon as a stable identifier", and that claims such as email, phone_number and preferred_username "MUST NOT be used as unique identifiers", because an issuer can reassign an email to a different person and a user's email can change. Keying accounts on email causes duplicate accounts after a name change, and in multi-tenant apps it can let one tenant's user sign in as another's.

The practical rule: store the issuer and subject pair as the account key, treat email as a mutable attribute, and use SCIM or a just-in-time update to keep attributes current.

See also: SSO, claims, SAML 2.0, OpenID Connect, cross-tenant token confusion, implementing SSO