SSO & Identity Providers

Overview

SKYCOT Enterprise will support centralized authentication through your organization's identity provider. Team members sign in with their corporate credentials — no separate SKYCOT passwords to manage. SSO integration is built on Supabase Auth's enterprise SSO capabilities, providing SAML 2.0 and OpenID Connect (OIDC) protocol support out of the box.

Once configured, SSO enforces your organization's existing authentication policies including multi-factor authentication, conditional access rules, and session management — all governed by your IdP rather than SKYCOT.

Supported Identity Providers

The following identity providers will be supported at launch. Any provider that implements standard SAML 2.0 or OIDC protocols can be connected via the custom configuration option.

Configuration Steps

Setting up SSO for your organization will follow this general workflow. Detailed setup guides for each provider will be published alongside the feature release.

1. Enable SSO in organization settings — An organization admin navigates to Settings and enables the SSO toggle. This activates the SSO configuration panel.
2. Select your identity provider — Choose from the supported list or select Custom SAML / Custom OIDC for unlisted providers.
3. Exchange metadata — SKYCOT provides an SP (Service Provider) metadata URL and ACS (Assertion Consumer Service) endpoint. You configure these in your IdP, then paste your IdP's metadata URL or XML into SKYCOT.
4. Map attributes — Configure attribute mapping for email, name, and optional group memberships. SKYCOT will provide sensible defaults for each supported provider.
5. Test the connection — Use the built-in test flow to verify authentication works before enforcing SSO for all team members.
6. Enforce SSO — Once verified, enable enforcement to require all organization members to authenticate via your IdP. Password-based login is disabled for enforced organizations.

SAML 2.0 Details

Security Features

• Signed SAML assertions with SHA-256 — SKYCOT validates the signature on every assertion before creating a session.
• Encrypted assertions supported for providers that require response encryption.
• Just-in-time (JIT) provisioning — new users are automatically created when they first authenticate via SSO, with roles assigned based on IdP group claims.
• Automatic deprovisioning — when a user is disabled in your IdP, their SKYCOT session is revoked on the next authentication check.
• Audit log of all SSO authentication events available in the organization admin panel.