Implementing SAML SSO for Enterprise B2B Applications

  <h2>What is SAML SSO?</h2>
  <p>SAML (Security Assertion Markup Language) is the standard for enterprise Single Sign-On. It allows employees to use their company credentials to access third-party applications.</p>
  
  <h2>Why SAML for B2B?</h2>
  <p>Enterprise customers expect SAML SSO:</p>
  <ul>
    <li>Centralized user management (IT controls access)</li>
    <li>Compliance requirements (SOC 2, ISO 27001)</li>
    <li>Better security (no password sharing)</li>
    <li>Improved UX (one login for all apps)</li>
  </ul>
  
  <h2>SAML Flow</h2>
  <p>SAML uses XML-based assertions to exchange authentication data:</p>
  <ol>
    <li>User tries to access your app</li>
    <li>App redirects to customer's Identity Provider (IdP)</li>
    <li>User logs in at IdP</li>
    <li>IdP sends SAML assertion to your app</li>
    <li>App validates assertion and creates session</li>
  </ol>
  
  <h2>Implementing SAML in Next.js</h2>
  <pre><code>// Install SAML library

npm install passport-saml

// Configure SAML strategy import { Strategy as SamlStrategy } from 'passport-saml';

const samlStrategy = new SamlStrategy({ entryPoint: 'https://customer-idp.com/sso', issuer: 'your-app-entity-id', callbackUrl: 'https://yourapp.com/auth/saml/callback', cert: customerCertificate, // From IdP metadata }, async (profile, done) => { // Find or create user const user = await User.findOneAndUpdate( { email: profile.email }, { email: profile.email, name: profile.displayName, samlNameId: profile.nameID, }, { upsert: true, new: true } );

done(null, user); });

  <h2>Multi-Tenant SAML</h2>
  <p>Each enterprise customer has their own IdP configuration:</p>
  <pre><code>// Store SAML configs per tenant

const samlConfig = await SAMLConfig.findOne({ tenantId });

const strategy = new SamlStrategy({ entryPoint: samlConfig.entryPoint, issuer: samlConfig.issuer, cert: samlConfig.certificate, // ... other config });

  <h2>Metadata Exchange</h2>
  <p>SAML requires metadata exchange between your app (SP) and customer's IdP:</p>
  <pre><code>// Generate SP metadata

export function generateSPMetadata() { return <?xml version="1.0"?> <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="your-app-entity-id"> <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://yourapp.com/auth/saml/callback" index="0"/> </SPSSODescriptor> </EntityDescriptor>; }

  <h2>Testing SAML</h2>
  <p>Use SAML test IdPs for development:</p>
  <ul>
    <li>OneLogin SAML Test Connector</li>
    <li>Okta Developer Edition</li>
    <li>Auth0 SAML IdP</li>
  </ul>
  
  <h2>Conclusion</h2>
  <p>SAML SSO is essential for B2B SaaS. While complex to implement, it's required for enterprise customers. Use a library like passport-saml, support multi-tenant configuration, and provide clear setup documentation for customers' IT teams.</p>