Okta SSO & SCIM Integration for Enterprise Health & Wellness Platform
An enterprise health and wellness SaaS platform needed to support large organizational customers who required Single Sign-On (SSO) for seamless employee access and automated user provisioning/deprovisioning via SCIM — a non-negotiable requirement for enterprise sales.
Discutez de Votre Projet
Le DĂ©fi
Enterprise customers refused to adopt the platform without identity federation and automated lifecycle management:
- SSO Requirement — IT departments mandated that employees log in via their corporate identity provider, not with separate credentials
- Manual Onboarding Overhead — Adding hundreds of employees manually when a new organization signed up took days of admin work
- Offboarding Risk — When employees left the organization, their platform accounts remained active for weeks, creating compliance and data access concerns
- Group-Based Access — Different employee groups needed different feature tiers and program access
- Multi-Tenant Complexity — Each enterprise customer had their own identity provider tenant with different configurations, attribute mappings, and group structures
- Existing Auth Coexistence — The platform already had email/password and OAuth-based authentication; SSO needed to coexist without breaking existing flows
Notre Solution
We implemented Okta SSO via SAML 2.0/OIDC for authentication and SCIM 2.0 for automated user provisioning, deprovisioning, and group synchronization — integrated into the existing multi-tenant backend.
Architecture
- Identity Provider: Okta (customer-managed tenants)
- SSO Protocol: SAML 2.0 (primary) + OIDC (alternative)
- Provisioning: SCIM 2.0 server built into the platform backend
- Backend: NestJS with PostgreSQL and Redis
- Auth Layer: JWT-based sessions with SSO-aware token issuance
- Admin Dashboard: React-based tenant configuration for SSO setup
- Existing Auth: Email/password + Google OAuth preserved alongside SSO
---
SSO Implementation (SAML 2.0 / OIDC)
SAML 2.0 Flow
The SP-initiated SAML flow works as follows: the user visits the login page and selects SSO, enters their company email domain, the platform identifies the tenant's Okta configuration from the domain, sends an AuthnRequest to Okta, the user authenticates, Okta returns a signed SAML assertion, the platform validates the assertion and creates a session with JWT tokens.
Per-Tenant Configuration
Each tenant's SSO is configured with their identity provider's SSO URL, entity ID, X.509 certificate for signature validation, along with the platform's SP entity ID, assertion consumer service URL, and attribute mappings from identity provider profile fields to platform user fields.
OIDC Alternative
For customers preferring OIDC over SAML, the platform supports Authorization Code flow with PKCE, using the same attribute mapping via OIDC claims and ID token validation with JWKS.
Multi-Tenant SSO Routing
The platform routes users to the correct identity provider based on their email domain. When a user enters their email, the platform looks up the domain against tenant SSO configurations. If SSO is configured, the user is redirected to their organization's Okta tenant. If not, they fall back to email/password or Google OAuth. Vanity URLs are also supported for direct SSO access. ---
SCIM 2.0 Implementation
SCIM Server
The platform exposes a SCIM 2.0 compliant API that Okta calls to manage users and groups. The API supports full user lifecycle operations (create, read, update, deactivate, delete), group CRUD with membership management, and standard SCIM discovery endpoints for capabilities, schemas, and resource types.
User Lifecycle via SCIM
Provisioning:When an admin assigns a user to the platform app in Okta, Okta sends a create request to the SCIM API. The platform creates the user account with tenant association, marks them as active and SSO-provisioned, and the user can immediately log in via SSO.
Profile Updates:When an admin updates a user's profile in Okta, the changes are pushed to the platform via SCIM. If department changes, group membership is re-evaluated automatically.
Deprovisioning:When a user is removed from the app in Okta, the platform deactivates the account — revoking all active sessions immediately, preventing further login, retaining data per retention policy, and freeing the license seat.
Reactivation:Re-assigning a user in Okta reactivates their account with all historical data intact.
Group Synchronization
Okta groups map to platform roles and program tiers — controlling access to different feature levels, admin capabilities, specialized dashboards, and exclusive program enrollments. Group membership changes in Okta are pushed via SCIM and reflected in real-time without requiring re-login. ---
Security & Authentication
Token Issuance After SSO
After SAML assertion validation, the platform issues tenant-scoped JWTs with claims for user identity, organization, roles (derived from SCIM group membership), authentication method, and identity provider — enabling audit differentiation between SSO and other auth methods.
Session Management
- SSO sessions respect Okta's session lifetime
- Single Logout (SLO) supported for session termination when user logs out of Okta
- Back-channel logout webhook for immediate session revocation
- SCIM deactivation revokes all active sessions within 60 seconds
Security Controls
- SAML response signature validation against tenant's X.509 certificate
- Assertion replay prevention via one-time-use tracking
- Clock skew tolerance for assertion timestamp validation
- Audience restriction validation
- Encrypted assertions supported for sensitive deployments
- SCIM endpoint authentication via per-tenant Bearer tokens
- Rate limiting on SCIM endpoints
---
Admin Configuration Dashboard
Tenant SSO Setup
The admin dashboard provides a self-service setup flow:
- Protocol Selection — Choose SAML 2.0 or OIDC
- Metadata Upload — Upload IdP metadata XML (auto-populates configuration)
- Attribute Mapping — Map identity provider profile fields to platform user fields
- Domain Verification — Verify ownership of email domain(s) for SSO routing
- Test Connection — Initiate test SSO login before enabling for all users
- SCIM Setup — Generate Bearer token for SCIM provisioning configuration
- Group Mapping — Map identity provider groups to platform roles and tiers
The dashboard also provides downloadable SP metadata for easy identity provider app configuration. ---
Key Features
- SAML 2.0 + OIDC Support — Flexible protocol choice per tenant
- SCIM 2.0 Provisioning — Automated user creation, updates, and deactivation
- Group-to-Role Mapping — Identity provider groups control platform access tiers and programs
- Instant Deprovisioning — SCIM deactivation revokes access within 60 seconds
- Multi-Tenant SSO Routing — Email domain-based IdP discovery across tenants
- Coexisting Auth Methods — SSO alongside email/password and Google OAuth
- Self-Service Setup — Admin dashboard for SSO configuration without engineering support
- Single Logout — Platform session terminated when user logs out of identity provider
- Audit Trail — Every SCIM operation and SSO event logged for compliance
- SCIM Group Sync — Real-time role and program changes from identity provider group membership
RĂ©sultats
Stack Technologique
caseStudyDetail.more Études de Cas
Découvrez plus de nos implémentations techniques
Traitement de factures assisté par l'IA avec OCR et intégration QuickBooks
Une entreprise de taille moyenne, traitant des centaines de factures fournisseurs chaque mois, devait éliminer la saisie manuelle des données en extrayant automatiquement les données des factures à l'aide de l'IA/OCR et en les synchronisant directement dans QuickBooks pour la tenue de livres et le suivi des paiements.
Insertion d'annonces côté client (CSAI) avec analyse des marqueurs SCTE-35 et intégration de lecteurs multiplateformes
Une plateforme de streaming vidéo devait implémenter l'insertion d'annonces côté client (CSAI) sur les applications web, mobiles et de télévision connectée — permettant des expériences publicitaires personnalisées au niveau de l'appareil avec un support complet d'interaction publicitaire (superpositions cliquables, bannières complémentaires, boutons de saut) que l'insertion côté serveur ne peut pas offrir.
PrĂŞt Ă Transformer Votre Entreprise ?
Discutons de la façon dont nous pouvons appliquer des solutions similaires à vos défis.