Lesson 10 of 10

SSO & Identity Edge Cases

A customer's SSO breaks after their identity provider migration, and suddenly nobody at that company can log in at all. Enterprise identity fails differently than a password does.

Beyond username and password

Four terms cover most of what you'll need to read an enterprise identity issue.

SAML

An XML-based protocol where the IdP asserts identity to your app via a signed assertion — common in older enterprise SSO setups.

OAuth / OIDC

OIDC layers identity on top of OAuth's authorization framework — the modern default for federated "login with X."

SCIM

System for Cross-domain Identity Management — how an IdP provisions and deprovisions accounts in your app automatically, not just authenticates them.

IdP

Okta, Azure AD/Entra, Google Workspace — the system of record for who an employee is and what they should have access to.

What actually breaks

Four failure modes account for most enterprise SSO incidents you'll see.

Stale signing certificate

The IdP rotates its signing cert; your app still has the old one cached, so every login fails at once for that customer.

SCIM deprovisioning lag

A user is removed from the IdP but still has access in your app because the SCIM sync failed or ran late.

Clock skew

SAML assertions have a validity window. If the IdP's or your service's clock has drifted, valid assertions get rejected as expired.

Attribute mapping mismatch

The IdP sends a group or role claim under one field name; your app expects another, so everyone logs in with the wrong — usually no — permissions.

Exercises

Look at the sanitized failure log below, then work through both exercises.

[SP]  SAML assertion rejected: signature validation failed
[SP]  Certificate fingerprint: 3B:2F:9A:1C:... (expires: 2026-06-01)
[IdP] New signing certificate active since: 2026-06-01

Concept check

Answer in your head first, then click a question to reveal the answer.

Scenario checklist

Work through the sample failure log and check each item off. Progress is saved in your browser.

Identify what's actually failing — all users at once vs. one userCheck whether this matches a known SSO failure pattern (cert rotation, clock skew, SCIM lag, mapping mismatch)Confirm the IdP-side change that lines up with the timingDistinguish an authentication failure from a provisioning/permissions failureDescribe the fix and who owns it — the customer's IdP admin or your team

Go deeper

These primers are a starting point. Read the primary sources to build real fluency.

Okta: SAML conceptsAssertions, signing, and why certificate rotation is the single most common SSO incident Okta: SCIM conceptsProvisioning and deprovisioning, distinct from authentication itself OpenID Foundation: How OpenID Connect worksThe modern OAuth-based alternative to SAML, from the standards body itself Okta: OAuth 2.0 and OpenID Connect overviewHow the two specs relate, for anyone who only knows one of them

Training Notes

What building this project taught me.

This deepens Auth, it doesn't repeat it

The existing Auth lesson covers API keys, OAuth, JWTs, scopes and roles from a request-level view. This lesson is enterprise identity federation — what breaks when a whole company's login goes through their own IdP instead of your app's own user table.

The failure log below is illustrative

Real SAML error messages vary significantly by IdP and service provider library — the shape (a rejected assertion, a cert fingerprint, a rotation date) is what to look for, not this exact wording.