For a B2B SaaS product there comes a moment when a larger customer asks: do you support SSO? Without single sign-on, a sale often fails at the customer’s IT department, which wants to manage access centrally and lock it immediately when an employee leaves.
The principle
Sign-in happens not in the application but at the customer’s identity provider, such as Microsoft Entra ID, Google Workspace or Okta. The application trusts this provider and, after a successful sign-in, receives a signed confirmation with the user’s identity and attributes. Application passwords disappear, and multi-factor authentication is enforced centrally.
SAML 2.0
SAML is the older, XML-based standard and widespread in enterprise environments. It works via browser redirects and signed assertions. It is robust and well supported, but error-prone to implement, for example in signature verification. Use proven libraries or a service rather than building it yourself.
OpenID Connect
OIDC builds on OAuth 2.0 and uses JSON Web Tokens. It is more modern, simpler to integrate for web and mobile applications and also supported by the major identity providers. Many new SaaS products offer both: OIDC as the default, SAML for customers whose IT requires it.
Provisioning with SCIM
SSO governs sign-in, not account management. Without provisioning an account remains in the application even if the user is locked at the customer; they just can no longer sign in. SCIM is the standard by which the identity provider creates, changes and deactivates accounts in the application. For enterprise customers with many users, SCIM is often the second question after SSO.
Multi-tenancy and common mistakes
In a multi-tenant application each customer needs its own SSO configuration, and assignment to the tenant must be unambiguous, for example via the email domain with verification. Common mistakes are missing domain verification, letting an attacker attach to someone else’s tenant, insufficient signature checks in SAML, missing sign-out across all sessions and an emergency access route that bypasses SSO and is forgotten. SSO is a central technical measure in data protection and belongs in every pre-launch security checklist.