April 22, 2026 — A week after SCIM shipped, the other half of the enterprise-identity story arrives: SyAuth can now act as a SAML 2.0 Identity Provider. Customer apps — Salesforce, AWS IAM Identity Center, a homegrown internal tool — can delegate sign-in to SyAuth, receive a signed assertion back, and trust it.
Paired with the SCIM server we shipped last week, SyAuth now covers the full SSO + Directory Sync checkbox that every enterprise procurement spreadsheet cares about.
What shipped
- SP-initiated SSO over HTTP-Redirect (request) and HTTP-POST (response) bindings.
- RSA-SHA256 signed assertions with enveloped XML-DSig and exclusive canonicalisation.
- IdP metadata endpoint at
/saml/metadata/so customers can configure their end in one click. - Configurable attribute mapping per Service Provider — emit
email,firstName,lastName, or any ExtsUser field as the SP expects. - Per-workspace management UI at
/security/saml. Register a customer app with its Entity ID, ACS URL, and attribute map; revoke the moment a relationship ends. - Full audit trail. Every SSO success, failure, SP registration, and change lands in your workspace's immutable audit log.
Security properties
- 5-minute assertion lifetime with 30-second clock-skew tolerance.
- ACS URL validated against the registered one — closes assertion-redirect open-redirect attacks.
- Audience restriction set to the SP's Entity ID — a captured assertion can't be replayed against a different SP.
InResponseToalways set; downstream SPs that enforce it will reject unsolicited assertions.
Setup
Generate an IdP keypair, set four env vars (SAML_IDP_ENTITY_ID, SAML_IDP_SSO_URL, SAML_IDP_CERT_PEM, SAML_IDP_KEY_PEM), register each Service Provider in the dashboard, and you're in business. Full walkthrough with Salesforce / AWS / custom-app examples on the developer portal.
Available today on every SyAuth plan.