SSO for SaaS: the feature every enterprise customer asks for

Every B2B SaaS product hits the same request: "we need SSO with our identity provider." It usually arrives from a customer large enough to have a security questionnaire, and it becomes a deal blocker if the answer is no.

SSO for SaaS is not one feature; it is a set of features that have to work per customer. This article covers what buyers expect, what it costs to buy, and what it costs to build.

What enterprise buyers actually ask for

The checklist from the buyer's side is predictable:

• SAML 2.0 support with their identity provider (Okta, Microsoft Entra ID, Google Workspace, OneLogin, Ping).
• A per-tenant connection: their settings, their certificate, their attribute mapping — not a shared global configuration.
• SP-initiated login, and often IdP-initiated login from their portal.
• JIT provisioning so users are created on first sign-in.
• SCIM so users are created, updated and deprovisioned without signing in.
• Group or role mapping, so access is driven by their directory.
• An admin screen where their IT team can configure and test the connection.
• Session and logout behavior they can defend in an audit: timeouts and single logout.

The first three get the deal moving. The rest decide whether the integration survives the security review.

What it costs to buy

The good news is that several vendors sell SSO as a service. The bad news is that the pricing is usually per connection, which is exactly the wrong unit for a SaaS with many small customers.

• WorkOS publishes $125 per connection per month for SSO, plus $99 per month for a custom domain on AuthKit.
• Auth0 includes one enterprise connection on its free tier; additional connections are a paid add-on per connection per month.
• Okta Customer Identity starts at a $3,000 per month platform fee, with suites and MAU add-ons quoted separately.
• Clerk does not include SSO on its free plan; enterprise SSO is a paid feature.

Do the arithmetic for your customer mix. A hundred enterprise customers at $125 per connection is $12,500 a month before you have charged anyone for your own product. That is why the build-vs-buy decision for SSO is really a pricing-model decision.

What it costs to build

If you build it yourself, the work is roughly:

1. A per-tenant connection model. Each tenant stores its IdP metadata, certificate, entity ID, ACS URL and attribute mapping.
2. A SAML service provider that validates signatures, audience, recipient and time windows, and rejects replays.
3. An OIDC client for customers whose IdP prefers OIDC, with PKCE for public clients.
4. A session layer that maps the assertion or token to a local user and tenant.
5. JIT provisioning, then SCIM for the customers who demand it.
6. An admin UI for customers to configure and test their connection.
7. Certificate rotation and metadata refresh, which is where integrations quietly break.
8. A support runbook for the inevitable "our users cannot log in" ticket.

The first version is a few weeks for an experienced team. The long tail — every IdP behaving slightly differently — is what makes it a permanent ownership cost.

The middle path

A third option is to use an identity provider that already implements SAML and OIDC per tenant, and connect your application to it once.

• Your application speaks one protocol to one identity provider, not N protocols to N customer IdPs.
• Each customer configures their own connection inside that identity provider.
• JIT and SCIM come with the identity provider instead of being your code.

With Casdoor, that means the customer's SAML or OIDC connection lives in their Casdoor organization, and your application integrates with Casdoor once. Self-hosted Casdoor does not charge per connection; the managed cloud starts at $9 per month with unlimited MAU and no per-connection fees.

How to ship it

1. Start with SAML and OIDC, per tenant. Do not special-case individual customers.
2. Add JIT first, then SCIM for the customers who ask.
3. Build the admin screen early. Customers configuring their own connection removes you from the critical path.
4. Test against the big three: Okta, Entra ID and Google Workspace. They cover most of the variance.
5. Document certificate rotation and set a reminder before every expiry.
6. Log every step of the flow with a correlation ID, so support can see where a login failed.

Related reading: add SSO to your app, multi-tenant authentication and SCIM vs SAML.