This page answers a frequent question from IT teams: "Does Swopi support SAML?" The answer is direct and transparent.
Summary: Swopi handles enterprise Single Sign-On (SSO) via Microsoft Entra ID using the OpenID Connect (OIDC) standard — the modern, recommended protocol built on top of OAuth 2.0. OIDC covers the same enterprise need as SAML (centralized sign-in with a corporate account, access control, automatic member creation). We deploy pure SAML 2.0 on request, not as the default.
#Why OIDC instead of SAML
SAML 2.0 and OpenID Connect both solve the same thing — federated sign-in against a corporate identity provider. OIDC is the newer standard, which:
- runs on top of OAuth 2.0 and uses compact signed JSON tokens (JWT) instead of XML,
- is natively supported in both Microsoft Entra ID and the Firebase Identity Platform that Swopi is built on,
- enables the same group-based role mapping as SAML (via the groups claim),
- has simpler and more robust verification (JWKS, discovery endpoint).
For the customer this means exactly what they expect from SSO: employees sign in with their corporate Microsoft account, IT controls access via Entra groups, and an employee leaving the directory loses their access.
#What this means for contracts and procurement requirements
If your requirement reads "OAuth 2.0 or OIDC", it is fully satisfied — Swopi uses precisely OIDC on top of OAuth 2.0.
If you have an internal standard that explicitly requires SAML 2.0, get in touch — we can deploy SAML on request as a separate option. We won't claim you get SAML "out of the box"; it is a targeted deliverable by agreement.
#How to do it (recommended path — OIDC)
The procedure for deploying enterprise SSO via Entra ID is described in a separate guide:
- SSO via Microsoft Entra ID (OIDC) — App Registration, redirect URI, groups claim, enforced SSO,
- Role mapping by Entra ID groups — how groups in Entra determine the Admin / Manager / Member role,
- Synchronizing members from Entra ID and SCIM 2.0 provisioning — automatic creation and removal of accounts.
#Comparison
| OIDC (default) | SAML 2.0 (on request) | |
|---|---|---|
| Status in Swopi | Fully supported | On request, by agreement |
| Protocol foundation | OAuth 2.0 / OpenID Connect | XML / SAML 2.0 |
| Sign-in with a corporate account | ✓ | ✓ |
| Role mapping by Entra groups | ✓ (groups claim) | ✓ (group assertion) |
| Enforced SSO + admin exception | ✓ | ✓ |
| Recommended by Microsoft for new integrations | ✓ | — |
#Troubleshooting
| Question | Answer |
|---|---|
| "Our security review wants SAML." | Send us the specific requirement — we'll deploy SAML on request. OIDC fulfills the same security function. |
| "The contract states OAuth2 or OIDC." | Satisfied — Swopi uses OIDC on top of OAuth 2.0. See the SSO guide. |
| "Can we start with OIDC and move to SAML?" | Yes. Role mapping (Entra groups) and member management stay the same; only the federation protocol changes. |
Integration contact: support@swopi.co