---
title: "SAML SSO"
description: "Connect enterprise identity providers using SAML 2.0."
locale: "en"
---

> Documentation Index
> Fetch the locale documentation index at: https://xid.dev/en/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO

## Service provider endpoints

| Endpoint | Description |
| --- | --- |
| `/sso/hrd` | Find the enterprise connection for a verified email domain. |
| `/sso/saml/{connection}/metadata` | SP metadata XML for the configured connection. |
| `/sso/saml/{connection}/login` | SP-initiated AuthnRequest redirect to the IdP. |
| `/sso/saml/{connection}/acs` | ACS endpoint for signed or encrypted SAML responses. |

## Security model

SAML is provider-ready: local and fake-IdP evidence covers the current Worker routes, and production readiness still requires a real IdP connection without recording SAMLResponse values or provider secrets.

- IdP certificates are stored on the connection. Browser-supplied KeyInfo is ignored.
- Assertions are validated for issuer, audience, recipient, time window, InResponseTo, and replay.
- EncryptedAssertion uses the configured SP decrypt key, then still requires the decrypted assertion signature to verify.
- XML security precheck and signature structure allowlist are covered locally. Full XSD validation and SAML Single Logout are not public-supported yet.
- XID currently acts as the SAML service provider for enterprise IdPs. Outbound SAML IdP for downstream SaaS apps has local fake-SaaS evidence, but production support still requires real SaaS admin L4.
- JIT provisioning can create or update users when the connection policy allows it.
- SCIM remains the recommended source for deprovisioning and group membership lifecycle.

Source: https://xid.dev/saml/index.mdx