---
title: "SAML"
description: "4 posts about SAML, summarised, each linking to the original."
---

# SAML
> 4 posts about SAML, summarised, each linking to the original.

## Articles

### [Introducing SCIM Provisioning in ClickHouse Cloud](https://yomu.fyi/post/introducing-scim-provisioning-in-clickhouse-cloud.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Sep 30, 2026
- Type: Announcement

ClickHouse Cloud introduces SCIM 2.0 provisioning, making the identity provider the single source of truth for user membership and role assignments. Previously, SAML SSO handled authentication but left user invites and role updates as manual tasks, creating security risks. SCIM provisioning automatically syncs user create, update, and delete operations from the IdP using standard SCIM 2.0 endpoints, maps IdP groups to custom ClickHouse roles via stable external IDs, supports up to two API keys for rotation, and provides audit logging for all provisioning actions. The feature requires an active SAML connection, is limited to verified domain SSO users, excludes system roles like Admin, and revokes all keys if SAML is disabled. It is generally available for Enterprise and BYOC organizations, validated with Okta and Microsoft Entra ID, and eliminates manual invite and deprovisioning tasks.


### [Introducing IdentiFlows.dev: A Visual Reference for Identity Flows](https://yomu.fyi/post/introducing-identiflows-dev-a-visual-reference-for-identity-flows.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Andrea Chiarelli
- Published: Sep 29, 2026
- Type: Announcement

Developers often struggle to quickly find accurate sequence diagrams for OAuth 2.0 and OpenID Connect flows. IdentiFlows.dev is a new website that provides a visual reference for common identity protocols, organized into four categories. Each flow page includes an introduction explaining the flow’s purpose, a sequence diagram showing the full exchange, and a step-by-step breakdown of each stage, with an interactive mode to walk through the steps. The initial release covers eight flows, including OAuth 2.0 Authorization Code with PKCE, the recommended login flow for most modern apps, SAML 2.0 SP-Initiated SSO, DPoP-Bound Access Token requests, and OpenID Connect Discovery. The project is an early release with plans to add more flows like Client Credentials, Device Authorization, and WebAuthn, and the author invites feedback to guide development.


### [How to Build and List Secure Cross App Access (XAA) Connections on Okta Integration Network (OIN)](https://yomu.fyi/post/how-to-build-and-list-secure-cross-app-access-xaa-connections-on-okta.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Gagan Sikri
- Published: Jul 6, 2026
- Type: Tutorial

Cross App Access (XAA) provides an identity framework for securing token-based communication when software or AI agents access external ecosystems through trusted identity providers. It replaces long-lived API keys and hardcoded secrets with real-time identity propagation, while allowing enterprises to control connected apps, requested scopes, and user access. The guide explains prerequisites for requesting and resource apps, including OIDC or SAML SSO, authorization-server support, protected resources, scopes, an Okta Integrator Free Plan org, and tested workflows. It then describes token exchange testing: requesting apps obtain an ID token and mint an ID-JAG, while resource apps validate the ID-JAG and issue a scoped access token. To seek OIN listing and XAA enablement, applicants submit SSO integration details, metadata, testing evidence, and a questionnaire to Okta.


### [Enabling Cross App Access for SAML-Based Resource Apps](https://yomu.fyi/post/enabling-cross-app-access-for-saml-based-resource-apps.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Updating authorization server metadata
- Published: Jul 3, 2026
- Type: Tutorial

Cross App Access (XAA) lets applications using existing SAML federation obtain API access without migrating to OpenID Connect (OIDC). An agent presents a short-lived Identity Assertion Authorization Grant (ID-JAG), which the resource authorization server validates, resolves to a user, and exchanges for its own access token; SAML processing remains upstream. For SAML identity resolution, implementations must validate the saml-nameid sub\_id and match issuer, NameID, and sp\_name\_qualifier rather than relying on NameID alone. The guide recommends binding iss to a registered SAML connection before verifying the JWT against that connection’s JWKS, then checking typ, aud, and client\_id and applying local scope policy. It also walks through Okta configuration and xaa.dev checks that redeem the ID-JAG, call the API, and export conformance results.