Single sign-on techniques

A service provider computing system associated with a service provider, the service provider computing system comprising:

• one or more processors;
• and
• one or more memories storing executable instructions that, when executed with the one or more processors, cause the service provider computing system to, at least:
• receive, from a user device, a single sign-on request message including an identity provider identifier associated with an identity provider;
• generate relay state data associated with the identity provider identifier;
• transmit, to the user device, the relay state data associated with the identity provider identifier;
• and
• receive, by the service provider computing system from the user device, the relay state data and security data, wherein receiving the relay state data and the security data causes the service provider computing system to provide access to the user device to at least one resource provided by the service provider.

One or more computer-readable storage media having collectively stored thereon computer-executable instructions that, when executed with one or more processors of a service provider computing system, collectively causes the service provider computing system to perform operations comprising:

• receiving, from a user device, a single sign-on message comprising an identity provider identifier associated with an identity provider;
• constructing relay state data associated with the identity provider identifier;
• transmitting the relay state data to the user device;
• and
• receiving, from the user device, a second message comprising security data and the relay state data, wherein receiving the security data and the relay state data causes the service provider computing system to provide access to the user device to at least one resource provided by a service provider associated with the service provider computing system.