IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Enterprise SSO & home-realm discovery
Business customers already have an identity provider. They do not want another password. They want their own company login. Your goal: send each person to the right company login without asking them to choose.
- Enterprise SSO lets staff sign in with their company login.
- You do not store their passwords. You trust a signed message.
- The email domain tells which company login to use.
- Verify domain ownership first, or an attacker can steal the routing.
Let customers bring their own IdP
Enterprise SSO lets a customer's staff sign in to your app with their company's IdP. An IdP is the identity provider, the system that knows who the staff are.
The two sides talk through a federation standard, SAML or OIDC. You trust a signed message from their IdP. It is called an assertion.
Think of your office ID card. The gate, the canteen and the lift all trust it. None of them makes its own card.
But what if you host a thousand customers? How does the login know which IdP a person uses?
Home-realm discovery: the email domain is the map
Home-realm discovery (HRD) answers that. It maps an email domain to the company connection that should sign that person in.
- The hosted login page asks for the email first.
- It reads the part after the @.
- It finds the matching connection.
- It sends the browser straight to that IdP.
Priya types priya@bigcorp.com. There is no menu. She lands on Bigcorp's own login. On her first visit, her account is made on the spot from the assertion. This is just-in-time creation.
Sam runs a store. His IT admin opens a setup link from you. The admin connects the company SAML IdP and proves that they own the domain. After that, everyone at sams-store.com is sent to their own login.
Verify domain ownership before you trust a domain-to-IdP map. Use a DNS TXT record for this. If you skip it, an attacker can claim another company's domain, such as bigcorp.com. They point it at their own login. Then Bigcorp's staff are sent to the attacker.
Also tie each connection to the customer's own organization. Then one customer's IdP never leaks into another's.
A hotel desk that looks at your company badge and sends you to your company lounge. Nobody asks "which club are you with?".
🧪 Interactive lab — enable JavaScript to play with this one.
Inspect a SAML connection and its assertions with SAML Scan and SAML Response Check.