Single sign-on at the operating system level

A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of an end user device, cause the end user device to perform operations comprising:

• as part of a login procedure of an operating system of the end user device, launching a single sign-on (SSO) login service that is part of the operating system of the end user device;
• displaying a login page of an identity provider through the SSO login service, wherein the login page allows a user of the end user device to submit authentication credentials for the identity provider;
• interacting with the identity provider to provide the authentication credentials to the identity provider and receive a plurality of secrets from the identity provider including an access token, an identity token, and a session cookie;
• logging the user into the operating system of the end user device using the identity token;
• and
• making the plurality of secrets available to one or more applications configured for the SSO login service thereby allowing the user to access the one or more applications without separately providing authentication credentials to the one or more applications.

An end user device, comprising:

• a set of one or more processors;
• and
• a non-transitory machine-readable storage medium that provides instructions that, when executed by the set of one or more processors, cause the end user device to perform operations comprising:
• as part of a login procedure of an operating system of the end user device, launching a single sign-on (SSO) login service that is part of the operating system of the end user device;
• displaying a login page of an identity provider through the SSO login service, wherein the login page allows a user of the end user device to submit authentication credentials for the identity provider;
• interacting with the identity provider to provide the authentication credentials to the identity provider and receive a plurality of secrets from the identity provider including an access token, an identity token, and a session cookie;
• logging the user into the operating system of the end user device using the identity token;
• and
• making the plurality of secrets available to one or more applications configured for the SSO login service thereby allowing the user to access the one or more applications without separately providing authentication credentials to the one or more applications.