starter.wiki中文

Identity

Single Sign-On

Choose when and how enterprise identity providers connect to the application.

Recommendation

Add enterprise SSO only when the customer and platform boundary is clear.

A standalone federation layer, bundled CIAM, and a wider B2B identity suite create different ownership and migration paths.123

For: B2B products evaluating SAML or OIDC enterprise connections

Main trade-off

Enterprise SSO adds federation configuration, tenant mapping, and support obligations; commercial impact must be verified separately.156

SSO delivery models

The choice starts with the existing identity platform and whether provisioning is part of the requirement.

  1. Existing identity platform

    Prefer the current provider's SSO when it meets protocol, connection, and operational requirements.24

  2. Provisioning scope

    Treat SCIM and directory sync as separate lifecycle requirements, not automatic consequences of SSO.56

  3. Customer isolation

    Map each connection to a verified organization or tenant boundary.15

  4. Commercial timing

    Do not build enterprise federation before a real sales or customer requirement justifies its ongoing support.15

SSO routes

Route by platform ownership and enterprise lifecycle scope.

Standalone enterprise federation

Use WorkOS SSO alongside the existing authentication system.

It isolates enterprise federation from the primary customer-identity implementation.

Verify: Confirm organization mapping, callback security, and lifecycle ownership.1

SSO bundled with customer identity

Use Auth0 or Clerk enterprise connections when either already owns application authentication.

Consolidation reduces duplicate identity integration and administration surfaces.

Verify: Validate connection limits, pricing, protocol support, and export paths.24

SSO plus provisioning and B2B administration

Evaluate Frontegg when the requirement extends beyond federation.

A broader B2B identity suite can package tenant administration with enterprise access.

Verify: Avoid suite adoption when only one or two SSO connections are needed.36

No contracted enterprise requirement

Defer SSO and keep conventional authentication.

Federation creates configuration, support, and security obligations that should follow validated demand.

Verify: Revisit when a target customer requires a named protocol or identity provider.15

Boundary: SSO authenticates through an enterprise identity provider; it does not by itself provision users or define application authorization.

What actually differs

Protocol checkboxes are less decisive than ownership, lifecycle, and commercial scope.

Federation boundary
Standalone SSO layers preserve the primary auth platform but add another operational dependency.1
Provisioning
SSO authenticates; SCIM or directory sync handles account lifecycle.56
Tenant mapping
Enterprise connections must resolve to the correct organization and policy context.124
Support burden
Every customer connection creates configuration and troubleshooting obligations.13

Official resources

Use protocol specifications and provider documentation to validate federation and provisioning boundaries.

Starter stacks

Sources

Primary sources supporting each SSO route.

  1. 1
    WorkOS Single Sign-On

    WorkOS · Accessed Official

  2. 2
    Auth0 enterprise identity providers

    Auth0 · Accessed Official

  3. 3
    Frontegg SSO overview

    Frontegg · Accessed Official

  4. 4
    Clerk enterprise connections

    Clerk · Accessed Official

  5. 5
    OpenID Connect Core

    OpenID Foundation · Accessed Official

  6. 6
    RFC 7644: SCIM protocol

    IETF · Accessed Official