Single Sign On Overview
Single Sign On (SSO) allows end users to authenticate to your application using their existing enterprise identity provider credentials. With Stytch, you can implement SSO as part of a fully-featured authentication stack or easily add enterprise-grade SSO capabilities to your existing infrastructure.
API Objects & Endpoints
| API Resources | Description |
|---|---|
| Organization | A top-level tenant that groups members, auth settings, roles, and other identity configurations. |
| Member | Represents an authenticated user who is a member of a specific Organization. |
| SAML Connection | Represents a SAML protocol-based connection with an identity provider. A SAML Connection is explicitly tied to an Organization, which can have multiple SAML Connections. |
| OIDC Connection | Represents an OIDC protocol-based connection with an identity provider. An OIDC Connection is explicitly tied to an Organization, which can have multiple OIDC Connections. |
| Member Session | A managed session that tracks a Member's logged-in state using JWTs or session tokens. |
How SSO Works
SSO involves two parties:
- Service Provider (SP): the application the end user is trying to access (your application)
- Identity Provider (IdP): the application that is verifying the end user's identity
For B2B applications like yours, the Identity Provider in the SSO exchange refers to the workforce IdP that your customers use to centrally manage their employees' access and identity information. When an end user authenticates through an Organization's SSO Connection this verifies both their identity as well as their authorization to access the Organization's instance on your application.
Implementing SSO on your own requires extensive work with various identity protocols and provider-specific implementations, but Stytch abstracts away those details for you, and the flow between you and Stytch will be the same regardless of the protocol used. Stytch handles the backend auth exchange with each identity provider, wrapping complex OIDC and SAML protocol flows into two simple API calls. Stytch supports both SAML 2.0 and OpenID Connect (OIDC), the two main protocols used for Enterprise SSO:
- SAML 2.0 (Security Assertion Markup Language): A mature standard used by many enterprise identity providers
- OIDC (OpenID Connect): A more modern protocol built on OAuth 2.0, used by providers like Google and Microsoft
You can read more about Stytch's SSO solution here.