starter.wiki搜索⌘KEN

任务决策

企业 SSO：在真实销售信号出现时接入，而非预先堆砌

为企业客户接入 SAML 或 OIDC，同时维护租户隔离和支持边界。

Recommendation

已有应用身份系统时优先接入 WorkOS；需要完整 CIAM 平台时评估 Auth0。

确认目标客户、身份提供商、目录同步与支持 SLA 是否已成为成交条件。123

适用范围： B2B products evaluating SAML or OIDC enterprise connections

Main trade-off

企业身份缩短采购阻力，但会带来配置、支持和用量成本。156

选择标准

按真实约束逐项判断，不要只比较功能列表。

  1. Existing identity platform

    Prefer the current provider's SSO when it meets protocol, connection, and operational requirements.24

  2. Provisioning scope

    Treat SCIM and directory sync as separate lifecycle requirements, not automatic consequences of SSO.56

  3. Customer isolation

    Map each connection to a verified organization or tenant boundary.15

  4. Commercial timing

    Do not build enterprise federation before a real sales or customer requirement justifies its ongoing support.15

适用路线

这些条件会改变默认答案；请在作出承诺前逐项验证。

Standalone enterprise federation

Use WorkOS SSO alongside the existing authentication system.

It isolates enterprise federation from the primary customer-identity implementation.

Verify: Confirm organization mapping, callback security, and lifecycle ownership.1

SSO bundled with customer identity

Use Auth0 or Clerk enterprise connections when either already owns application authentication.

Consolidation reduces duplicate identity integration and administration surfaces.

Verify: Validate connection limits, pricing, protocol support, and export paths.24

SSO plus provisioning and B2B administration

Evaluate Frontegg when the requirement extends beyond federation.

A broader B2B identity suite can package tenant administration with enterprise access.

Verify: Avoid suite adoption when only one or two SSO connections are needed.36

No contracted enterprise requirement

Defer SSO and keep conventional authentication.

Federation creates configuration, support, and security obligations that should follow validated demand.

Verify: Revisit when a target customer requires a named protocol or identity provider.15

边界： SSO authenticates through an enterprise identity provider; it does not by itself provision users or define application authorization.

关键差异

把真正会改变决策的边界单独比较。

Federation boundary
Standalone SSO layers preserve the primary auth platform but add another operational dependency.1
Provisioning
SSO authenticates; SCIM or directory sync handles account lifecycle.56
Tenant mapping
Enterprise connections must resolve to the correct organization and policy context.124
Support burden
Every customer connection creates configuration and troubleshooting obligations.13

官方资源

官方文档与继续决策的正式路径。

来源

支撑页面关键主张的资料。

  1. 1
    WorkOS Single Sign-On

    WorkOS · Accessed Official

  2. 2
    Auth0 enterprise identity providers

    Auth0 · Accessed Official

  3. 3
    Frontegg SSO overview

    Frontegg · Accessed Official

  4. 4
    Clerk enterprise connections

    Clerk · Accessed Official

  5. 5
    OpenID Connect Core

    OpenID Foundation · Accessed Official

  6. 6
    RFC 7644: SCIM protocol

    IETF · Accessed Official