SSOJet

The five values that unblock an enterprise SSO integration, the two metadata attributes that silently default to false, and a copy-paste handoff block you can send today.

31% of breaches in the last 10 years used stolen credentials. (Verizon DBIR 2024) No exploit. No zero-day. A valid email and password, sent to the same POST /login your users hit. To your login handler, that request is correct. Same body, same headers, 200 OK. Rate limits slow it down. Logs see it after the fact. What changes the number is what you ship: → SSO: the password lives at the customer's IdP, not in your database → Passkeys (WebAuthn): nothing to phish, nothing to reuse → MFA: a stolen password alone stops working → Breached-password check at sign-up and reset: reject passwords already in leak corpuses (the HIBP range API does it with k-anonymity; you send 5 hash characters, not the password) Every password you don't store is one that can't be stolen from you, or reused against you. Which of these four is on your login page today? #AppSec #Authentication #Passkeys #EnterpriseSSO #DevSecOps

Fixture assertions with pinned clocks, a throwaway IdP in CI, contract-testing SCIM against the RFC's own examples, and the four regressions only a real IdP will catch.

Learn how to simplify technical security concepts like SSO, MFA, authentication, authorization, RBAC, and SCIM with clear, easy-to-understand explanations.

SAML shipped a PartialLogout status code because the designers knew it would half-fail. OIDC front-channel logout is broken by browser third-party blocking. What to build instead.

Imagine an employee asks an AI assistant to summarize customer records. Should the assistant access every record in the company database, or only the records that employee is allowed to see? If the AI uses a highly privileged service account, it might retrieve information the employee couldn't access directly. That's an authorization problem, not just an AI safety problem. A safer design considers whose identity is making the request, which resources they can access, and whether those permissions are enforced by the underlying systems. AI should not become a shortcut around existing access controls. How would you design permissions for an AI assistant working with sensitive company data?

“The customer just needs SSO.” What that sentence costs an engineering team: 47 identity providers, each configured slightly differently. SAML and OIDC, because the customer list has both. SCIM, because offboarding is part of the security review. JIT, MFA, audit logs, because procurement asks. One line in the requirements. One quarter of roadmap. Enterprise SSO is a product, not a feature. Treat it like one, or buy it like one. What did “just” cost your team last time? #EnterpriseSSO #SaaS #DevHumor

Discover enterprise-ready physical security solutions for device management, cybersecurity, and compliance. Learn how SSOJet enhances access and reduces costs.

Someone leaves the company. How long does their login to your app stay alive? Without SCIM, offboarding is a ticket. HR tells IT, IT tells you, someone finds the account and disables it. Days, if anyone remembers. With SCIM, the admin removes them in Okta or Entra ID. The directory sends a deprovision request to SSOJet. Access to your app is gone in seconds, and nobody filed a ticket. SCIM is the whole lifecycle: create, update, deactivate, group changes. Pushed by the directory, not polled by you. One thing it will not do for you: kill the session that is already open. Revoke tokens and sessions on the deprovision event, and test it before you switch it on for a customer. SSOJet speaks SCIM 2.0 with Okta, Entra ID and any directory that does. Docs in the comments. #SCIM #EnterpriseSSO #B2BSaaS

The IdP authenticated once; your app issues its own session and the two expire independently. SessionNotOnOrAfter, max_age, auth_time, and the NIST timeouts enterprise buyers cite.