---
title: "Enterprise SSO"
description: "Configure upstream enterprise IdPs and track downstream SaaS SSO boundaries without overstating production support."
locale: "en"
---

> Documentation Index
> Fetch the locale documentation index at: https://xid.dev/en/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise SSO

## Two directions

Inbound enterprise SSO means XID acts as the SAML service provider or OIDC relying party for a company IdP. Downstream SaaS SSO means XID acts as the SAML or OIDC identity provider for apps such as Slack, GitHub Enterprise Cloud, Microsoft custom apps, Atlassian, Salesforce, and Zoom.

Both directions are separate evidence lines. A local fake IdP or fake SaaS run verifies the implementation baseline, but only a real external IdP or SaaS admin run can support a production-supported claim.

```mermaid
flowchart LR
  IdP -->|SAML / OIDC| xidSp["XID SP / RP"]
  xidIdP["XID IdP"] -->|SAML / OIDC| SaaS
```

## Upstream enterprise IdP status

| Provider | Protocols | Status |
| --- | --- | --- |
| Microsoft Entra ID | SAML, OIDC, SCIM inbound | Provider-ready, missing real IdP L4. |
| Okta | SAML, OIDC, SCIM inbound | Provider-ready, missing real IdP L4. |
| Google Workspace | SAML, OIDC, SCIM inbound | Provider-ready, missing real IdP L4. |
| OneLogin | SAML, OIDC, SCIM inbound | Provider-ready, missing real IdP L4. |
| JumpCloud | SAML, OIDC, SCIM inbound | Provider-ready, missing real IdP L4. |
| PingOne | SAML, OIDC | Provider-ready, missing real IdP L4. |
| PingFederate | SAML, OIDC | Provider-ready, missing real IdP L4. |
| AD FS | SAML, OIDC, WS-Fed legacy baseline | Implemented locally; real AD FS WS-Fed L4 missing. |
| Shibboleth | SAML, OIDC | Provider-ready, missing real IdP L4. |
| Keycloak | SAML, OIDC, LDAP legacy baseline | Implemented locally; native Kerberos bridge is documented-only. |

## Downstream SaaS SSO status

| SaaS | Direction | Status |
| --- | --- | --- |
| Slack | XID as SAML IdP | Provider-ready with local outbound SAML baseline; real Slack admin L4 missing. |
| GitHub Enterprise Cloud | XID as SAML IdP | Provider-ready with local outbound SAML baseline; real GitHub Enterprise L4 missing. |
| Microsoft custom enterprise app | XID as SAML or OIDC IdP | Provider-ready with generic SAML/OIDC baseline; real Entra custom app L4 missing. |
| Atlassian | XID as SAML IdP | Provider-ready with local outbound SAML baseline; real Atlassian admin L4 missing. |
| Salesforce | XID as SAML or OIDC IdP | Provider-ready with generic SAML/OIDC baseline; real Salesforce admin L4 missing. |
| Zoom | XID as SAML or OIDC IdP | Provider-ready with generic SAML/OIDC baseline; real Zoom admin L4 missing. |

## Legacy protocol boundaries

- LDAP direct bind, WS-Federation, SWA password vaulting, header-based SSO, and directory connector framework are implemented locally with fake harness L3. Real AD/LDAP gateway, AD FS WS-Fed, target app vault, and Application Proxy L4 are still missing.
- Linked sign-on, native IWA, and Kerberos termination are not supported.
- SAML Single Logout is not supported.
- Provider-ready rows must not be described as production-supported until real external L4 evidence exists.

Source: https://xid.dev/enterprise-sso/index.mdx