Enterprise SSO
Close enterprise deals.
Not engineering tickets.
SAML 2.0, OIDC, LDAP/AD -- configured from your dashboard in minutes. Domain routing auto-detects the right IdP. JIT provisioning creates users on first login.
Available on Starter and above. See pricing
The protocols
Standards on the wire. No bespoke integrations.
Enterprise SSO is two standards doing one job. In SAML 2.0, the IdP returns a
signed XML assertion to your Assertion Consumer Service over an HTTP-POST binding; AuthFI
validates the signature against the IdP's certificate, checks the audience, conditions and NotOnOrAfter window, then mints a session. In OIDC, the same trust
rides the authorization-code flow with PKCE — AuthFI exchanges the code at the token endpoint and
verifies the ID token's iss, aud and signature against the published JWKS.
- SP-initiated: user starts at your app, AuthFI redirects to the IdP, the IdP posts an assertion back.
- IdP-initiated: user starts in Okta/Entra and is dropped straight into your app — both supported.
- Metadata exchange: entity IDs, endpoints and signing certs swapped once, then trust is self-describing.
- One implementation per protocol, not one per customer — the security review you pass once, you've passed for every tenant.
<saml:Assertion ID="_a1b2c3"
IssueInstant="2026-06-21T09:14:22Z">
<saml:Issuer>https://acme.okta.com</saml:Issuer>
<ds:Signature>… RSA-SHA256, enveloped …</ds:Signature>
<saml:Subject>
<saml:NameID>alice@acme.com</saml:NameID>
</saml:Subject>
<saml:Conditions
NotOnOrAfter="2026-06-21T09:19:22Z">
<saml:AudienceRestriction>
authfi:sp:acme</saml:AudienceRestriction>
</saml:Conditions>
</saml:Assertion>AuthFI verifies the signature, audience and clock window before a session ever exists.
name@company.comalice@acme.com → Okta SAMLbob@stark.com → Azure AD OIDCcarol@legacy.corp → On-prem LDAPdave@gmail.com → Google socialDomain routing
Type an email. Land at the right IdP.
Home-realm discovery is the part that makes one login page serve a hundred enterprises.
The user types their email; AuthFI reads the domain, looks up the SSO connection that owns it,
and redirects to that exact IdP — Okta for acme.com, Entra for stark.com,
on-prem LDAP for legacy.corp. Unknown domains fall through to social or
username/password.
- No IdP picker, no "which company are you with?" — the email is the routing key.
- One verified domain can be claimed per connection, so a customer's users can't be hijacked onto the wrong tenant.
- It removes the help-desk password load: enterprise users never see a password field, so there's nothing to reset, phish, or breach.
Lifecycle
Provisioned on first login. Deprovisioned the moment HR clicks.
Just-in-time provisioning creates the AuthFI user from the assertion itself: the first successful
SSO login maps IdP attributes to a profile, assigns groups and roles, and skips the invite email
entirely. SCIM 2.0 closes the other end of the lifecycle — when the customer's
directory disables or removes someone, a PATCH deactivates the AuthFI user in near
real time. JIT handles onboarding; SCIM handles the offboarding that audits actually care about.
- The problem it removes: orphaned access — accounts that outlive the employee because nobody told your app they left.
- Attribute & role mapping:
memberOf→ groups,department→ metadata, applied on every assertion so roles stay current. - The payoff: a clean "joiner-mover-leaver" trail for SOC 2 / access reviews, with zero manual user admin.
| FROM IdP | TO AUTHFI | EXAMPLE |
|---|---|---|
| NameID / sub | alice@acme.com | |
| displayName | name | Alice Chen |
| memberOf | groups | ["engineering"] |
| department | metadata | {"dept": "Eng"} |
PATCH active:false → user disabledSecurity model
Signed, scoped, and single-logout aware.
The trust in federation lives entirely in the cryptography and the session boundary. AuthFI signs and (where the IdP requires it) encrypts assertions, pins each one to a short validity window and a single audience, and propagates logout so a session can't outlive its mandate.
Signed assertions
Every assertion carries an enveloped RSA-SHA256 signature over canonicalized XML. AuthFI rejects anything whose signature doesn't validate against the IdP's published certificate — no signature, no session.
Encryption & replay defense
Encrypted assertions (XML-Enc) are decrypted with the per-tenant key. Audience restriction, one-time InResponseTo correlation and the NotOnOrAfter clock window block replay and token reuse.
Sessions & SLO
AuthFI issues its own session after assertion validation, independent of the IdP cookie. SAML Single Logout (SLO) fans the sign-out back to the IdP and sibling SPs, so one logout means logged-out everywhere.
Federate outboundNew
AuthFI as your SAML Identity Provider.
The same engine runs in reverse. Federate out to Salesforce, GitHub Enterprise, Slack, AWS Console, Google Workspace — any app that speaks SAML 2.0. Paste their metadata, copy ours into theirs, assign a group, done. One click signs your users into every SaaS in your stack.
Register an app in 60 seconds
- 1Paste the SP's metadata XML, or fill entity ID + ACS URL manually.
- 2Copy your auto-published IdP metadata URL into the SP's setup form.
- 3Assign a group — every member sees the tile on their portal.
Tiles on the launcher, signed in on click
Configured from the console
Three protocols. Every IdP. No code.
Upload metadata or paste a discovery URL. A connection is live in about 10 minutes — and it's a config row, not a branch in your codebase.
SAML 2.0
Enterprise standard. Upload IdP metadata XML. AuthFI handles assertion parsing, signature validation, attribute mapping.
OIDC
Modern OpenID Connect. Provide a discovery URL and client credentials. Authorization code flow with PKCE.
LDAP / AD
On-prem directory. Bind to LDAP, search users, validate credentials. LDAPS for encryption.
SSO Connections
+ Add connection
SAML Active
OIDC Active LDAP ActiveGet started
Ready to get started?
Free for 5,000 monthly active users. No credit card required.