Service provider endpoints
| Endpoint | Description |
|---|---|
/sso/hrd |
Find the enterprise connection for a verified email domain. |
/sso/saml/{connection}/metadata |
SP metadata XML for the configured connection. |
/sso/saml/{connection}/login |
SP-initiated AuthnRequest redirect to the IdP. |
/sso/saml/{connection}/acs |
ACS endpoint for signed or encrypted SAML responses. |
Security model
SAML is provider-ready: local and fake-IdP evidence covers the current Worker routes, and production readiness still requires a real IdP connection without recording SAMLResponse values or provider secrets.
- IdP certificates are stored on the connection. Browser-supplied KeyInfo is ignored.
- Assertions are validated for issuer, audience, recipient, time window, InResponseTo, and replay.
- EncryptedAssertion uses the configured SP decrypt key, then still requires the decrypted assertion signature to verify.
- XML security precheck and signature structure allowlist are covered locally. Full XSD validation and SAML Single Logout are not public-supported yet.
- XID currently acts as the SAML service provider for enterprise IdPs. Outbound SAML IdP for downstream SaaS apps has local fake-SaaS evidence, but production support still requires real SaaS admin L4.
- JIT provisioning can create or update users when the connection policy allows it.
- SCIM remains the recommended source for deprovisioning and group membership lifecycle.