title: "Single Sign-On (SSO) for SaaS — Generated and Wired In | Archiet" description: "SaaS single sign-on takes weeks to wire correctly. Archiet generates Google, Microsoft, Okta, GitHub, and SAML SSO ready to deploy — with the user model, session handling, and admin controls already in place." slug: single-sign-on-saas type: use-case primary_keyword: "single sign on saas" secondary_keywords:
- sso saas
- sso saas implementation
- implementing sso
- saas sso integration
- saml sso saas
- okta sso saas
- google sso saas
- microsoft sso saas published_at: 2026-05-15
Single Sign-On (SSO) for SaaS — Generated, Not Hand-Wired
Implementing SSO in a SaaS application is a multi-week project. The hard parts:
- Wiring OAuth 2.0 / OpenID Connect with Google, Microsoft, GitHub
- Adding SAML for enterprise customers (Okta, Azure AD, OneLogin)
- Mapping external identity → internal user (matching by email, handling conflicts)
- Just-in-time (JIT) provisioning of new users
- Linking multiple identities to one account
- Enforcing SSO-only at the workspace level for paying enterprise customers
- Handling SSO logout (initiator + RP-initiated)
Archiet generates all of it as production code in your stack of choice.
What's in the generated SSO
OAuth 2.0 / OIDC providers
- Google — Sign in with Google, configurable hosted-domain restriction
- Microsoft — Personal + work/school accounts via Microsoft Identity
- GitHub — Developer-friendly identity
- GitLab / Bitbucket — Optional
- Apple Sign In — For consumer apps
SAML 2.0 (Enterprise)
- Generic SAML 2.0 with metadata XML upload
- Okta — Pre-configured profile
- Azure AD / Entra ID — Pre-configured profile
- OneLogin — Pre-configured profile
- Google Workspace SAML — Pre-configured profile
SCIM 2.0 (Provisioning)
- User provisioning + de-provisioning from your customer's IdP
- Group sync for role assignment
- Compatible with Okta + Azure AD + OneLogin
Account linking
- "Sign in with Google" creates a new account if the email is unknown
- If the email matches an existing account, the user is prompted to link (after verifying the password)
- Multiple SSO methods can link to one account
- Admin can force-unlink
Workspace-level SSO enforcement
- Enterprise admin can enable SSO-only for their workspace
- Once enabled, password login is disabled for that workspace
- Optional: enforce a specific IdP (e.g. only Okta)
Audit
- Every SSO event (login, link, unlink, enforce-on) is logged
- Admin can see who signed in via which provider
Stack support
| Stack | SSO library used | |---|---| | Flask | Authlib + python3-saml | | FastAPI | Authlib + python3-saml | | Django | django-allauth + djangosaml2 | | NestJS | passport-oauth2 + node-saml | | Laravel | Socialite + LightSAML | | Rails | OmniAuth + ruby-saml | | Go | dex / goth + crewjam/saml | | Java Spring Boot | Spring Security OAuth + OpenSAML | | .NET | Microsoft.Identity.Web + Sustainsys.Saml2 |
The library choices are best-in-class for each stack and are battle-tested at enterprise scale.
What you skip vs. building from scratch
- 1 week reading OAuth 2.0 + OIDC specs
- 1 week reading SAML 2.0 spec
- 1 week wiring each provider (Google, Microsoft, GitHub, generic SAML, Okta, Azure AD)
- 1 week on JIT provisioning and identity matching
- 1 week on workspace-level enforcement and admin UI
- 1 week of edge-case bug fixes (clock skew, email mismatch, account merging)
Six to eight weeks of work, generated in one ZIP.
How it compares to SSO-as-a-service (WorkOS, Stytch, Auth0)
| | WorkOS / Stytch / Auth0 | Archiet | |---|---|---| | Time to first SSO login | 1–3 days | Generated in your ZIP | | Ongoing cost | Per-user, per-month | Zero — code is yours | | Vendor lock-in | High | None | | Custom auth logic | ⚠️ Limited extension hooks | ✅ Plain source code | | SOC 2 evidence | Provided by vendor | You own the auth layer (SOC 2 vendor's evidence is for theirs) | | Self-hosting | ❌ | ✅ |
WorkOS / Stytch / Auth0 are great if you want zero auth code. Archiet is the right choice if you want owned auth code with SSO already wired.
Try it
Generate a SaaS with SSO. The generated ZIP includes a quick-start guide for configuring each SSO provider.