Which SSO protocol is commonly used for CLM, and what is essential?

• A. OAuth 2.0; rely on client credentials
• B. SAML 2.0; map user attributes and trust the identity provider
• C. OpenID Connect; no attribute mapping needed
• D. Basic authentication; no identity provider

Answer: (B)

SSO in CLM relies on federated identity: the identity provider authenticates the user and issues a trusted assertion to CLM so the system can grant access without forcing another login. SAML 2.0 is the protocol most commonly used for this in enterprise CLM deployments. The essential part is mapping the user attributes from the identity provider to CLM’s user profile and establishing trust by exchanging metadata and certificates so CLM can verify the assertion. With proper attribute mapping (like user ID, email, and role or group memberships) and a trusted provider setup, users can sign in once and receive the correct permissions in CLM.

OpenID Connect can also support SSO, but the critical requirement in CLM remains aligning provider-sent attributes with CLM’s authorization model and maintaining a trusted setup. OAuth 2.0 client credentials are geared toward machine-to-machine access and don’t provide end-user SSO. Basic authentication offers no federated identity or SSO mechanism.