SAML 2.0 · OpenID Connect · MFA · SCIM
Corporate SSO with SAML 2.0 and OpenID Connect
Single sign-on that lets your employees log into the workshop portal and SDK with their own directory credentials — Okta, Azure AD, Google Workspace, OneLogin, JumpCloud, Auth0. Delivered via SAML 2.0 or OpenID Connect per your IdP. SCIM provisioning is available on the enterprise programme.
What corporate SSO covers
Corporate SSO covers four surfaces. The customer portal where the operations lead checks order status, downloads invoices, sees delivery history and uploads the size database. The SDK where developers consult documentation, generate bearer tokens for the API and test webhooks. The integrations console where the technical admin configures endpoints, secrets and event subscriptions. The compliance panel where the compliance officer consults audit documentation and downloads certificates.
SSO works with your IdP — Okta, Azure AD, Google Workspace, OneLogin, JumpCloud, Auth0, Duo — without us having access to user credentials. Authentication happens on the customer's side; we receive the signed assertion and validate the signature with the IdP certificate. Session is managed with httpOnly, secure and strict sameSite cookies.
SAML 2.0: the standard flow
The SAML 2.0 flow is the most used at corporates running Okta, Azure AD and OneLogin. The customer creates the SAML application in their IdP with the ACS — Assertion Consumer Service — pointing to https://portal.corp-merch.com.mx/sso/saml/acs and the EntityID at https://portal.corp-merch.com.mx. NameID is mapped to the user's email. The attributes we receive are email, firstName, lastName and groups.
IdP groups map to roles inside the workshop. The corp-merch-admins group maps to customer administrator with full access to the portal and SDK. The corp-merch-ops group maps to operator with access to orders and deliveries. The corp-merch-readonly group maps to reader with query-only access. The corp-merch-finance group maps to the finance role with access to invoices and payments.
OpenID Connect: the flow for Google Workspace and Auth0
The OpenID Connect flow is used with Google Workspace, Auth0 and IdPs that prefer OAuth 2.0 with an identity layer. The customer creates the OIDC application in their IdP with the redirect URI https://portal.corp-merch.com.mx/sso/oidc/callback. The scopes we request are openid, email, profile and groups when the IdP supports it.
Token validation happens against the IdP's JWKS endpoint. The ID token signature is validated with RS256 and we verify the audience — aud — matches our client ID. Expiration — exp — is validated with five-minute tolerance. The user identifier — sub — is used to keep the session consistent across devices.
Multi-factor authentication and session policy
Multi-factor authentication is enforced on the customer's IdP side, not ours. When the customer configures mandatory MFA on their IdP, the user must complete the second factor before reaching our portal. We support typical MFA methods: TOTP, WebAuthn, push notification, SMS where the IdP allows it. When the customer requires MFA on every login, we respect it.
Session policy applies by default: eight-hour session with auto-renewal while the user is active, cookie expiration at twenty-four hours of inactivity, re-authentication for sensitive actions — config change, size database download, bearer token rotation — with five-minute lifetime. For customers with stricter policy we configure session at programme start per their internal procedure.
SCIM provisioning
For enterprise customers — more than one hundred users — we deliver SCIM 2.0 provisioning. The customer can create, update and delete users from their IdP without our involvement. The SCIM endpoint is https://portal.corp-merch.com.mx/scim/v2 with dedicated bearer token authentication, separate from the SDK bearer token.
SCIM provisioning respects IdP groups. When a user is added to the corp-merch-ops group, their role is automatically updated to operator. When removed from the group, the role is revoked. When the user is deleted from the IdP, their account is deactivated in our portal. Provisioning events are recorded in the audit log the customer can query.
Setup, support and testing
Setup runs in a session with the customer's technical lead and our technical lead. We deliver the SAML metadata — the XML with EntityID, ACS and certificate — or the OIDC configuration — client ID, client secret and redirect URI — and we walk the customer through their IdP configuration. The typical session lasts an hour and leaves SSO running on the sandbox.
Once the sandbox is validated, we move the configuration to production with a change in the workshop portal. The change applies in under five minutes. When the customer requires cutover in a specific window — a weekend, a maintenance window — we programme it on their timeline. For customers with strict SLA — banking, fintech, government — we deliver a cutover runbook with documented steps.
Set up your SSO with Corp-Merch.MX
If your corporate requires SSO with your IdP for the workshop portal and SDK, let's talk. We deliver the SAML metadata or OIDC configuration, walk you through setup and leave SSO running in under one working session.
Corporate SSO is delivered to clients on an active programme with a signed usage agreement. Authentication happens on the customer's IdP side; Corp-Merch.MX does not store user passwords. Configuration may update without prior notice; major versions are communicated with thirty days' notice. Corp-Merch.MX is a Mexican workshop for corporate merch; we operate independently.