Connect each customer's SAML identity provider without writing SAML code
When a larger business buys your product, its IT team will ask for single sign-on through its SAML identity provider, such as Entra ID, Okta or Google Workspace. The Skycloak Platform is designed to take that SAML connection on for you, one per customer, and to hand your application the same OpenID Connect tokens it already uses for everyone else.
What a SAML identity provider is, and why customers insist on it
SAML is an older XML-based standard for single sign-on. A company's SAML identity provider is the directory where its employees already sign in each morning, and it sends a signed assertion to each application to say who the employee is. Security teams like it because they can grant and revoke access to every application from one place.
For a software company, that means each enterprise customer arrives with its own identity provider, its own metadata and its own certificate that expires on its own schedule. Supporting them one by one in your own code turns into a long tail of XML parsing, clock skew and certificate rotation problems.
How the Platform sits between them and your app
On the Platform, each business customer is an organization in your tenant, and enterprise SSO over SAML is on the plan through Ory Polis, an open-source SAML service. The customer's IT team configures one SAML connection for their organization, and their employees then sign in through their own identity provider.
Your application does not change. It still redirects to your tenant with OpenID Connect and still receives an ID token and an access token, now for a user who signed in through their company's directory. One integration in your code covers every customer's SAML setup.
Provisioning and roles alongside SSO
Single sign-on answers who someone is, but customers also want people added and removed automatically. Inbound SCIM is on the plan as well: the customer's directory sends users and groups to the Platform, and each organization maps its directory groups to its own roles in your product.
When IT removes someone from a mapped group, that person loses the role in that organization only. We describe a feature as available only once it has shipped, so a demo is where you see which parts of this you can use today.
Frequently asked questions
Does my application need to understand SAML?
No. The Platform is built to handle the SAML side with each customer's identity provider and to give your application standard OpenID Connect tokens.
Which SAML identity providers will it connect to?
Any that follows the SAML 2.0 standard, which includes Entra ID, Okta, Google Workspace, Ping and ADFS.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.