Enterprise SSO: SAML 2.0 and OIDC Integration

Q: Enterprise SSO: SAML 2.0 and OIDC Integration

For SSO in Spring Boot you pick between **OIDC** (`spring-boot-starter-oauth2-client`) — modern JSON-based, mobile-friendly — and **SAML 2.0** (`spring-security-saml2-service-provider`) — XML-based, required by many enterprise IdPs. Both follow the same conceptual flow: **redirect to IdP -> authenticate -> signed assertion/token returned -> app validates and creates local session**. Configuration involves registering with the IdP (client ID/secret for OIDC; metadata XML + signing keys for SAML), mapping IdP claims/attributes to roles, **JIT user provisioning**, and **Single Logout (SLO)**. Common pitfalls: **redirect URI mismatch**, **signature validation**, **clock skew**, **claim mapping**, **cert rotation**. **Modern B2B default**: OIDC primary, SAML fallback for enterprise mandate.

Intermediate·2 min read·

OktaAzureAuth0KeycloakWorkos

Fast recall

Quick revision

Core answer

For SSO in Spring Boot you pick between OIDC (spring-boot-starter-oauth2-client) — modern JSON-based, mobile-friendly — and SAML 2.0 (spring-security-saml2-service-provider) — XML-based, required by many enterprise IdPs. Both follow the same conceptual flow: redirect to IdP -> authenticate -> signed assertion/token returned -> app validates and creates local session. Configuration involves registering with the IdP (client ID/secret for OIDC; metadata XML + signing keys for SAML), mapping IdP claims/attributes to roles, JIT user provisioning, and Single Logout (SLO). Common pitfalls: redirect URI mismatch, signature validation, clock skew, claim mapping, cert rotation. Modern B2B default: OIDC primary, SAML fallback for enterprise mandate.

Interview-ready guide

Interview answer

OIDC vs SAML quick framing

OIDC: modern JSON-based, mobile-friendly, primary choice for new integrations
SAML: XML-based, enterprise-required (banks, gov, healthcare); fallback for B2B
Both: redirect to IdP -> auth -> signed response -> local session

OIDC in Spring Boot

spring-boot-starter-oauth2-client
application.yml: spring.security.oauth2.client.registration. + provider..issuer-uri
oauth2Login(...) DSL, userInfoEndpoint.userAuthoritiesMapper for role mapping
OidcClientInitiatedLogoutSuccessHandler for SLO
@AuthenticationPrincipal OidcUser in controllers
PKCE automatic with client-authentication-method=none

SAML 2.0 in Spring Boot

spring-security-saml2-service-provider
spring.security.saml2.relyingparty.registration. with assertingparty.metadata-uri
saml2Login() and saml2Logout() DSL
OpenSaml4AuthenticationProvider with setResponseAuthenticationConverter for attribute mapping
Cert rotation via multiple verification.credentials

Multi-tenant

Resolve tenant from subdomain or email domain
Custom repository sourced from DB

JIT provisioning

First login -> create local user from IdP attributes
Use federated ID (issuer + subject), not just email

Common pitfalls

Redirect URI mismatch (exact match required)
Clock skew on assertion validity
Cert rotation breaking auth
Claim mapping silently dropping roles
SameSite=Strict breaking callback POST
Logout only local without SLO -> one-click re-login

2026 default

OIDC primary, SAML on enterprise request
Use IdP aggregator (Auth0, WorkOS) for many customer IdPs

03 · Deep dive