Ship enterprise SSO (SAML and OIDC)

Why enterprises demand it

• Enterprises mandate SSO so access follows their central IdP and offboarding
• It is the single most common gate on B2B deals moving upmarket
• Security teams require federated identity for audit and control

How to implement

1. 1Attach SSO connections to the Organization, not the global app
2. 2Support both SAML 2.0 and OIDC; enterprises are split across both
3. 3Verify the customer's email domain, then route those users to their connection
4. 4Provide self-serve connection setup with test and metadata upload
5. 5Handle both SP-initiated and IdP-initiated flows

Standards

• SAML 2.0
• OpenID Connect (OIDC)
• OAuth 2.1

Pitfalls

Build checklist

• ☐SSO connections scoped to the Organization
• ☐Both SAML and OIDC supported
• ☐Domain-verified routing to the right connection
• ☐Self-serve setup with a test flow
• ☐SP- and IdP-initiated flows handled

FAQ

Do I need both SAML and OIDC for enterprise SSO?

In practice, yes. Enterprise IdPs are split, some standardize on SAML, others on OIDC, so supporting both avoids losing deals over a protocol mismatch. Route users to the right connection by verified email domain.

Should SSO be per-organization or global?

Per-organization. Each enterprise customer brings its own IdP, so connections must attach to the Organization and be self-serve. A single global connection cannot isolate customers or scale across many IdPs.