Connect enterprise sign-in through SAML
Support a customer’s SAML identity provider without rebuilding the sign-in and account-linking flow. Wildo validates the returned assertion and connects it to the intended organization’s account policy.
Connection metadata, certificates and tenant binding remain explicit, including when several customers use the same identity provider.
Example — Keep two customers on their own connections
Two organizations use the same directory vendor. A returned assertion must identify the intended customer through the validated connection and signed audience, not just the provider name.
For engineers
Prepare both sides of the connection
Enable AuthMethod.ORG_SAML for the relevant user type and configure the scope’s SAML connection. Exchange the application’s service-provider metadata and the identity provider’s settings, including certificates and endpoints. The configured runtime must provide the XML-validation helper used by the SAML implementation.
Create the organization-owned SSO connection with protocol: SsoProtocol.SAML, a displayName, and the provider’s saml settings. The following excerpt from sso-connection.shared.schemas.ts shows the connection fields the settings form and request contract use:
saml: z.object({
entityId: z.string().min(1).isAuditEvidence(),
ssoUrl: z.url().isAuditEvidence(),
sloUrl: z.url().optional().isAuditEvidence(),
x509CertificatePem: z.string().min(1).optional(),
x509Certificates: z.array(z.string()).min(1).isBackendOnly(),
attributeMapping: z.object({
email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),
firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),
lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),
roles: z.string().optional(),
department: z.string().optional(),
employeeId: z.string().optional(),
groups: z.string().optional(),
}),
signRequests: z.boolean().default(true).isAuditEvidence(),
wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),
This is the relevant portion of the existing schema, not a complete connection payload. Enter the IdP’s entity identifier and SSO endpoint, supply its signing certificate through x509CertificatePem, and align attribute names with the assertions it sends. The backend derives the internal certificate array; clients do not write that backend-only field. Connection-level allowedDomains, defaultRole and autoCreateUsers govern who can enter and how new local accounts are provisioned.
On the provider side, use Wildo’s service-provider metadata for the intended organization. The metadata endpoint supplies that configuration; the assertion-consumer endpoint receives the provider’s response. Enable the connection and start sign-in through it: a valid assertion then enters the local account and membership resolution flow.
Bind the assertion before selecting the customer
SP-initiated sign-in carries request correlation. For IdP-initiated sign-in, the engine validates candidate connections against their configured certificates before selecting a scope. If several tenants share an identity provider and certificate, the signed audience must identify one intended tenant; unresolved ambiguity is refused.
Assertion conditions and replay protection are handled by the validator and replay guard. An unsigned issuer label is not tenant authority. Multiple configured certificates support certificate rollover without disabling validation.
Complete the account and logout lifecycle
After validation, the enterprise provisioning path resolves the local account and membership under the connection’s policy. SAML completion checks the local account and issues tokens on its callback path; it does not automatically enter the native MFA challenge continuation. Set the customer’s provider assurance requirements deliberately rather than assuming local mfaPolicy is translated into a SAML demand. Separate SAML logout paths manage the federated session behavior. Test the customer’s configured login direction and logout path with its provider; protocol support alone does not establish that a particular customer’s metadata and certificates are correct.