Per-org SAML 2.0 SSO

An alternative to OIDC for organizations standardized on SAML 2.0: each org configures its own identity provider, and DekEn validates the signed SAML Response with hardening against XML signature-wrapping (XSW) attacks.

• An enterprise customer's identity stack is SAML-only (no OIDC available from their IdP)
• You're configuring the Issuer, SSO URL, and signing certificate for a new SAML integration
• You're reviewing SSO security posture and need signature-wrapping attacks covered, not just 'is it signed'

Validates the IdP's signed <Response> using signxml, checking the Issuer and guarding against comment-truncation and XML signature-wrapping (XSW) forgeries — a known class of SAML implementation bug — rather than trusting an unwrapped assertion at face value.