Authentication & Authorization Architecture · Strong Authentication and Federation
Single Sign-On, Federation and Provisioning
Enterprise SSO with OIDC and SAML, plus SCIM user provisioning.
B2B products are expected to support single sign-on: customers' employees log in through their own identity provider (Okta, Entra ID, Google Workspace) via OIDC or SAML 2.0. Map each customer organization to its IdP connection (often via email domain), and use SCIM for automated user provisioning and deprovisioning so access is removed when employees leave. Many teams use an identity platform (Auth0, WorkOS, Keycloak) instead of implementing SAML directly.
Home-realm discovery
1. User enters [email protected]
2. App finds tenant 'acme' → SSO connection (SAML or OIDC)
3. Redirect to Acme's IdP; IdP authenticates (with Acme's MFA policies)
4. IdP returns SAML assertion / OIDC tokens → app validates signature, audience, issuer, expiry
5. Just-in-time provisioning or SCIM-synced user record; map IdP groups → app roles
SCIM: IdP → POST /scim/v2/Users, PATCH /Users/{id} {active: false} on offboarding
Common pitfalls
- Accepting unsigned or replayed SAML assertions (use mature libraries).
- Not deprovisioning users removed in the customer's IdP.
- Letting users bypass SSO with local passwords when the tenant requires SSO.
Key points
- OIDC or SAML for enterprise SSO
- SCIM for lifecycle (joiner/mover/leaver)
- Map IdP groups to app roles per tenant
Further reading: SCIM standard
Practice questions
Why is SCIM important in addition to SSO?
Answer
SSO controls login, but existing sessions, API tokens and local accounts may persist; SCIM lets the customer's IdP create, update and deactivate users automatically, so offboarding actually removes access.
What is home-realm discovery?
Answer
Determining which identity provider should authenticate a user, usually from their email domain or tenant subdomain, before redirecting them to that IdP.
Open in the app to mark lessons complete, take notes and track your progress.