What is the best SSO approach for existing username/password auth?

The “best” SSO approach for an existing username/password system is usually:

1) Move to an external Identity Provider (IdP) using OIDC

Best default choice: OpenID Connect (OIDC) on top of OAuth 2.0 with a mature IdP like:

• Okta
• Auth0
• Microsoft Entra ID (Azure AD)
• Ping
• Keycloak (self-hosted)

Why this is usually best

• Modern and widely supported
• Works well for web, mobile, and APIs
• Safer than rolling your own SSO
• Lets you keep your app as a relying party instead of an auth provider
• Easier user lifecycle management, MFA, conditional access, federation, etc.

2) If your system already has usernames/passwords, do not try to “SSO-sync” passwords

Avoid trying to:

• copy passwords between systems
• share password hashes across apps
• build custom “central password database” SSO

That becomes brittle and risky.

3) Migration strategy for existing local auth

A practical path is:

Option A: Gradual migration to federated login

• Keep existing username/password login temporarily
• Add “Sign in with Company SSO” using OIDC/SAML
• When users log in via SSO, link their account
• Eventually encourage or require SSO

Option B: Use your app as an auth broker

If you must keep legacy credentials:

• Your app can authenticate against the old username/password store
• On success, issue your own session/JWT
• But for true SSO across systems, you still want a central IdP

Option C: Migrate accounts to an IdP

• Create users in the IdP
• Support password reset / invitation flows
• Link existing accounts by verified email or admin mapping

4) SAML vs OIDC

• OIDC: best for new integrations and modern apps
• SAML: still common in enterprises, especially older SaaS and B2B environments

If you have a choice, prefer OIDC unless an enterprise customer specifically requires SAML.

5) Recommended architecture

A common setup:

• Central IdP handles login, MFA, password policy
• Your apps redirect to IdP for authentication
• App receives an ID token / assertion
• App creates its own local session
• User can access multiple apps without re-entering credentials

6) Important implementation notes

• Use Authorization Code Flow with PKCE
• Validate tokens properly
• Keep short-lived access tokens
• Use refresh tokens carefully
• Support logout/session expiration
• Map IdP identity to a stable internal user ID
• Don’t rely only on email as a permanent identifier

Bottom line

If you already have username/password auth and want SSO, the best approach is usually:

Adopt a central Identity Provider and integrate your app(s) with OpenID Connect, migrating existing users gradually.

If you want, I can also give you:

1. a migration plan for an existing app,
2. a decision tree for OIDC vs SAML, or
3. a reference architecture for web + mobile + API.