SSO (SAML, OIDC)

Single sign-on delegates authentication to the customer's identity provider (IdP) such as Microsoft Entra, Okta or Google Workspace. Your product becomes a service provider that trusts assertions from the IdP instead of storing passwords. SAML is the older XML-based standard still required by many large enterprises; OIDC is the JSON and OAuth 2.0 based standard that is simpler to implement and common with newer IdPs. Most enterprise-ready products support both.

The pieces that matter in practice are domain-based routing (users from acme.com go to Acme's IdP), just-in-time user provisioning, mapping IdP groups to your product's roles, and enforcing SSO so that once a customer switches it on, password login is disabled for their tenant. SCIM provisioning, which pushes user creation and deactivation from the IdP, is often bundled in the same procurement requirement.

SSO is about who the user is, not what they can do. Authorisation still lives in your RBAC model. It is also different from social login for consumer apps, which uses similar protocols but no enterprise IdP contract.

• Founder / CEO: SSO is a gate on enterprise deals; without it, IT teams often refuse to approve the purchase.
• CISO: central identity means leavers lose access immediately and MFA policy is enforced by the customer, not by each vendor.
• CTO / Head of Engineering: implementing SAML by hand is error-prone; the decision is usually between a library and an identity service, and it affects the user model.
• Support manager: SSO misconfiguration is a common onboarding ticket, so clear setup screens and test-connection tools reduce support load.

SSO exists because enterprises cannot manage hundreds of separate password databases across the tools their staff use. Central identity gives them one place to enforce MFA, one place to offboard leavers and one audit trail of logins. For the vendor, the trade-off is implementation effort, per-tenant configuration and edge cases like users who belong to two customers, in exchange for clearing a procurement requirement that otherwise blocks larger contracts entirely.

• A B2B SaaS product adding SAML and OIDC with per-tenant enforcement to pass an enterprise security review.
• A FinTech platform where bank staff log in via the bank's IdP so access ends automatically when an employee leaves.
• A university portal federating student and staff login through the institution's existing identity system.
• A hospital network's operational software where clinicians sign in with hospital credentials and roles map to departments.
• A logistics dispatch platform where each transport company's ops team authenticates through their own Microsoft or Google accounts.

Standard / regulationSAML and OIDC are open protocol specifications you implement against. Eazyware adds SSO, SCIM and role mapping to new and existing SaaS products under the SaaS development and API integrations services.

Eazyware service that covers it: SaaS / Cloud-native Application Development. Starting prices are on the pricing page.