Federation and SSO
Nevis ID speaks the modern identity protocols on both sides of a federation: as OpenID Connect provider and OAuth 2.0 authorization server toward your applications, and as relying party toward external identity sources for bring-your-own-identity (BYOI) with social login (Google, Apple, Facebook, Microsoft), corporate IdPs, and government E-IDs. SAML 2.0 is supported in both the IdP and SP roles, including SP-initiated and IdP-initiated SSO and single logout, and legacy enterprise estates are modernized in place, up to the ADFS plugin, which brings passkeys and mobile authentication into Microsoft AD FS. Applications and APIs receive standard JWT tokens (JWS, JWE) with JWT-based client authentication (RFC 7523). Inbound and outbound federation, clients, sessions, and consents are administered over REST APIs and the management console.
Also known as
modern identity protocols, OIDC/OAuth2/SAML/JWT, SSO, BYOI, social login, inbound/outbound federation, single logout.
At a glance
| Role and protocol | Support |
|---|---|
| OpenID provider, OAuth 2.0 authorization server | Authorization code with PKCE and client credentials grants; hybrid and implicit flows; access, ID, and refresh tokens; OIDC discovery and AS metadata (RFC 8414); UserInfo; consent management; dynamic client registration (OAuth 2.0 and OIDC); resource indicators (RFC 8707); pushed authorization requests (PAR, RFC 9126); token introspection (RFC 7662); token revocation (RFC 7009) |
| Token and key standards | JWT, JWS, JWE, JWK; client authentication and authorization grants with JWT assertions (RFC 7521, RFC 7523) |
| Custom implementations | Device authorization grant, client registration management, the JWT access-token profile, and the step-up authentication challenge are supported via custom implementations (not strictly conformant to RFC 8628 / 7592 / 9068 / 9470) |
| On roadmap | Token exchange (RFC 8693); DPoP (RFC 9449); OIDC back-channel and RP-initiated logout |
| OIDC relying party (inbound federation, BYOI) | Social login with Google, Apple, Facebook, and Microsoft; generic OIDC providers and corporate IdPs; government E-IDs (see also E-ID, Wallets, and Verifiable Credentials) |
| SAML 2.0 as IdP | SP-initiated SSO (default) and IdP-initiated SSO (opt-in); single logout, SP- and IdP-initiated, concurrent, or sequential; metadata service; response and assertion signing and encryption; HTTP-POST and HTTP-Redirect bindings; step-up via RequestedAuthnContext |
| SAML 2.0 as SP | SP-initiated SSO against one or several IdPs; HTTP artifact binding; strict signature validation and message decryption; single logout; session upgrade via the external IdP |
| WS-Federation | WebSSO (passive requestor) profile in IdP and relying party roles, including single sign-out; provided by the nevisAuth engine (advanced configuration) |
| Enterprise coexistence and migration | Passkey and mobile authentication inside an existing Microsoft AD FS estate through the ADFS plugin (OIDC-based, with just-in-time provisioning of AD-mastered users); SAP SSO logon tickets and WS-Security token profiles (UsernameToken, X.509, SAML) for legacy application integration; WS-Trust client toward an external STS as a migration bridge |
| Security best practices | OAuth 2.0 Security BCP (RFC 9700); native apps (RFC 8252); browser-based apps |
Concepts
- Federation and social login APIs: how patterns expose the OAuth 2.0, OIDC, and SAML endpoints, and the split between public and administration APIs
How-to Guides
- Social login with Google
- Federation in the management console: connect identity providers and relying parties
- How to use the API: bearer-token access to the federation administration endpoints
- Digital identities (e-ID): BYOI through government e-IDs (covered in depth by the E-ID hub)
References
- OAuth 2.0 / OIDC patterns: OAuth 2.0 Authorization Server / OpenID Provider, Dynamic Client Registration Endpoint, JWKs Endpoint, Metadata Endpoint, Pushed Authorization Request Endpoint, Token Introspection Endpoint, Token Revocation Endpoint, User Info
- SAML patterns, IdP side: SAML IDP, SAML SP Connector, SAML Token
- SAML patterns, SP side: SAML SP Realm, SAML IDP Connector, SAML Response Consumer, SAML SP Backend Integration
- Social login patterns: Google, Apple, Facebook, Microsoft, Generic Social Login Step, Social Login Create User, Social Login Link User, Social Login Done
- Token and session patterns: JWT Token, JWT Access Restriction, Access Token Consumer, Token Header Propagation, Nevis SecToken, SAP Logon Ticket, Logout
- OAuth/OIDC APIs: Authorizations, Token handling, PAR, Token introspection, Token revocation, Metadata handling, User information, OAuth consent management
- Client and setup administration APIs: Clients, Client management, Client data, Applications, Resource servers
- SAML and session APIs: SAML, Session management
- nevisAuth engine references: WS-Federation, WS-Trust, Web Services Security, SAP integration
- Data model: clients and the system overview