Single sign-on across clusters: NVIDIA says repeat logins fell 55%

You sign in once at nine in the morning. By lunch three more windows have asked who you are, and one of them wants the two-factor code again. Two NVIDIA engineers published how they stopped that happening inside their own company, and the number they report for single sign-on across clusters is a 55% drop in repeat logins.

Why one login is never one login

Big companies do not run one computer system. They run dozens, spread across data centres in different countries, and the tools for training AI models add more. Each of those systems was built to check who you are on its own. Single sign-on proves you at the front door of the building, and then every room asks again, because no room trusts the corridor.

The second half of the problem is worse and quieter. Click log out in one tool and you are still signed in to the rest. An employee who leaves on Friday can keep an open session somewhere until it expires on its own.

“SSO proves the user at the front door. Platform teams who manage a federated data or AI platform across multiple clusters still need a reliable way to carry that user context into distributed execution environments without handing raw tokens to every application, weakening revocation, or forcing each cluster to reimplement identity-provider logic.”

— Bhagat Khemchandani and Rohan Somvanshi, NVIDIA, NVIDIA Technical Blog, 3 September 2026

Quote source: NVIDIA Technical Blog, 3 September 2026

What they built, in plain words

The fix the authors describe is closer to a cloakroom ticket than to a new lock. One gateway in the middle does the real login, using OpenID Connect, the standard behind most sign-in buttons. It writes down that you are logged in, keeps that note in one shared place with an expiry time, and hands your browser a cookie.

After that, four things happen on every request:

1. the regional gateway nearest you receives it and asks the central one who you are
2. the central one answers from its note, without sending you back to the login screen
3. the regional gateway attaches the answer to the request and passes it to the application
4. the application reads the name and the permissions and never touches your login token

Logging out deletes the one note. Every platform loses you at the same moment, which is the part the engineers seem to care about most.

Why it matters outside NVIDIA

Revocation is the reason this matters beyond NVIDIA. When somebody leaves, or a token leaks, the security team wants one delete to cut access everywhere. The usual arrangement scatters copies of your credentials across clusters, and every copy is a place where the delete can miss. The same weakness shows up in ordinary account takeovers, where a stolen session outlives the password change that was supposed to kill it.

It costs something. A single point that answers who everyone is becomes a single point that can fail, and we wrote this week about three AI providers going down inside half an hour. If the central gateway is unavailable, nobody signs in anywhere, and the shared note store has to be treated with the seriousness of a database rather than a cache.

The trade is between many small failures and one large one, and NVIDIA picked the large one on purpose. That is a defensible choice for a company that also funds defensive security work, and a bad one for anyone who builds the middle without a spare.

Nothing here should be taken as financial advice; treat it as information to consider.