Identity & Access · scenario
Corporate SSO
Enterprise Identity Provider → OIDC / SAML → Integration Lab
Overview
- Business problem
- Security teams refuse standalone credentials for an external assessment platform. Access must follow joiner/mover/leaver processes in the corporate directory.
- Typical customer
- Enterprises running Entra ID, Okta, Ping or ADFS with a central access-governance policy.
- Integration objective
- Authenticate employees in the corporate IdP and map claims to a Integration Lab session with no local password.
- Systems involved
- Corporate IdP
- Integration Lab
- Optional internal portal
- Integration Lab capabilities used
- OIDC authorization code flow
- SAML 2.0 SP/IdP-initiated
- Claim/attribute mapping
- Just-in-time provisioning
- Expected outcome
- A deprovisioned employee loses assessment access at the directory level, with no orphaned local accounts.
Workflow
The happy path, step by step.
- 01
User opens Integration Lab or portal link
User
SP-initiated flow begins; unauthenticated request is redirected.
- 02
Authorization request to IdP
Integration Lab
Redirect with client_id, scope, state, nonce and PKCE challenge.
- 03
Authentication + MFA
Identity Provider
Corporate policy applies: MFA, device compliance, conditional access.
- 04
Authorization code returned
Identity Provider
Code delivered to the redirect URI; state validated.
- 05
Token exchange & claim mapping
Integration Lab
ID token validated; sub/email/name/external_id mapped to the candidate profile.
- 06
Session established
Integration Lab
Candidate lands on their assessment list, provisioned just in time.
Negative lifecycle events
How access is revoked, shortened or refused.
Signature or audience mismatch
Integration Lab
Assertion rejected; the user sees a federation error rather than a partial session.
User deprovisioned in the directory
Identity Provider
Authentication fails at the IdP, so Integration Lab access ends without a separate offboarding step.