---
title: "SAML SSO"
description: "Connect enterprise identity providers using SAML 2.0."
locale: "en"
---

> Documentation Index
> Fetch the relevant documentation index at: https://vonvon.id/en/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO

## Service provider endpoints

| Endpoint | Description |
| --- | --- |
| `/sso/hrd` | Find the enterprise connection for a verified email domain. |
| `/sso/saml/{connection}/metadata` | SP metadata XML for the configured connection. |
| `/sso/saml/{connection}/login` | SP-initiated AuthnRequest redirect to the IdP. |
| `/sso/saml/{connection}/acs` | ACS endpoint for signed or encrypted SAML responses. |

## Security model

SAML is provider-ready: local and fake-IdP evidence covers the current Worker routes, and production readiness still requires a real IdP connection without recording SAMLResponse values or provider secrets.

- IdP certificates are stored on the connection. Browser-supplied KeyInfo is ignored.
- Assertions are validated for issuer, audience, recipient, time window, InResponseTo, and replay.
- EncryptedAssertion uses the configured SP decrypt key, then still requires the decrypted assertion signature to verify.
- XML security prechecks, a recursive structural schema allowlist, and the signature/reference structure allowlist are implemented and verified locally. The structural allowlist validates the SAML Response before signature verification and each decrypted Assertion again; it is a closed grammar for the consumed SAML profile, not a general XSD engine. Inbound and outbound SAML Single Logout is covered locally at L1/L2. The Slack profile is excluded because Slack does not support SLO, and real provider L4 evidence remains UNKNOWN.
- Vonvon currently acts as the SAML service provider for enterprise IdPs. Outbound SAML IdP for downstream SaaS apps has local fake-SaaS evidence, but production support still requires real SaaS admin L4.
- JIT provisioning can create or update users when the connection policy allows it.
- SCIM remains the recommended source for deprovisioning and group membership lifecycle.

Source: https://vonvon.id/saml/index.mdx