SAML

WorkOS is a technology company focused on providing enterprise-grade identity authentication and user management infrastructure for SaaS applications, with products covering core enterprise IT capabilities such as SSO (Single Sign-On), SCIM directory synchronization, and audit logs.

SSO implementation typically relies on standard protocols such as SAML or OIDC, integrating with enterprise identity providers such as Okta, Azure AD, and Google Workspace.

OIDC (OpenID Connect) is built on top of OAuth 2.0, uses JSON and JWT, is more lightweight and easier to debug, and is gradually replacing SAML as the first choice for new projects.

One of WorkOS's core values is encapsulating the complexity of supporting multiple SSO protocols (SAML, OIDC, etc.) into an API that developers can quickly integrate.

Implementing conditional access usually requires the identity provider (IdP) to support claim extensions such as acr and amr in SAML/OIDC, and to be able to pass policy decision results to the application.

It is recommended to prioritize OIDC for new products targeting developers or consumers, and to treat SAML as a mandatory but controlled compatibility layer for enterprise-facing products.

For B2B SaaS vendors, supporting SAML SSO is often a hard prerequisite for getting onto enterprise procurement lists.

The core approach to reducing SAML risk is to isolate SAML processing, avoiding hand-written XML parsing and signature verification logic, and instead using audited mature libraries or dedicated identity gateways.

The ideal architecture is to establish an authentication adapter layer at the system boundary that handles SAML interactions with enterprise IdPs and then uniformly converts them internally into OIDC ID Tokens or internal JWTs, so that core business code never directly touches SAML's XML.

Keycloak, as an intermediary layer, can simultaneously support connecting to upstream SAML IdPs and issuing OIDC tokens to downstream applications, making SAML invisible to the application side.

The identity federation space experienced competition among SAML, OpenID, and WS-Federation, with OpenID Connect ultimately prevailing in consumer internet scenarios and SAML continuing in enterprise scenarios.

LDAP, SAML, and OIDC authentication features are paid enterprise-edition-exclusive features in Mattermost.

Antimatter rebuilt from scratch features that previously only existed in the enterprise edition, including LDAP, SAML, and OIDC authentication, as well as multilingual translation.

Developers should not implement SAML or XML signature verification themselves, but should use mature libraries that have been thoroughly audited.

The larger the protocol, the more optional features it has, and the more complex its parsing paths are, the higher the threshold for correct implementation and the greater the probability of errors—security and complexity are often inversely related.

The SAML specification is voluminous and filled with optional features and extension points, and differing interpretations of the specification by various IdPs and SPs lead to interoperability issues.

When integrating SAML, one should strictly validate the signature scope of assertions, audience restrictions, validity time windows, and IdP origin.

SAML (Security Assertion Markup Language) has long been the de facto standard in the enterprise single sign-on (SSO) space.

SAML is built on top of XML and relies heavily on XML Digital Signatures (XML DSig) and XML Encryption.

EMA allows enterprise IT administrators to batch-create, link, and even deactivate employee accounts in third-party services via the SCIM protocol or SAML/OIDC assertions.