Integrate once
Applications use one discoverable OIDC issuer instead of owning a different enterprise protocol integration for every customer.
Enterprise identity connections
One sign-on contract. Every customer’s identity provider.
FastSSO gives independent applications one standards-first OIDC boundary while each customer brings SAASPASS, Okta, Entra, Google Workspace, or another SAML/OIDC provider.
Educational release · downstream OIDC runs today · unfinished upstream authentication fails closed
Identity routeGuarded preview
Customer identitySAASPASS · Okta · Entra · SAML/OIDC
↓
FastSSO brokerDiscovery · normalization · audit boundary
↓
Your applicationAuthorization Code + S256 PKCE
OIDCSAML 2.0SCIM-shapedTenant-aware
Keep tenants separate
Verified domains select tenant-scoped connections. Exact redirect allowlists and normalized subjects preserve the trust boundary.
See what is unfinished
Security-sensitive adapters remain explicit HTTP 501 responses until validation, replay protection, and conformance tests are complete.
Integration guide
Start with SAASPASS.
Use SAASPASS for workforce authentication and MFA, then let FastSSO normalize that identity into the same downstream contract every Fast* application can consume.
SAASPASS
Proposed upstream OIDC partnerSAASPASS documents Generic OIDC, Authorization Code, PKCE, signed ID tokens, UserInfo, SAML, and REST integration options.
Visit SAASPASS ↗SAASPASS
MFA + identity→FastSSO
validation + mapping→Fast* app
OIDC + PKCE
MFA + identity→FastSSO
validation + mapping→Fast* app
OIDC + PKCE
The recommended first implementation is tenant-scoped Generic OIDC. It keeps SAASPASS credentials and tokens behind the adapter boundary while FastSSO emits stable claims such as sub, email, organization_id, and connection_id.
Built around the trust boundary
Secure by being explicit.
FastSSO is not a password store or authorization engine. It brokers authentication and leaves application policy with the application.
Exact registered callback matching
Mandatory downstream S256 PKCE
Tenant-scoped identity mapping
Redacted admin connection data
Short-lived, one-time codes
Fail-closed unfinished adapters
For developers
View source ↗A small, inspectable protocol surface.
Use discovery and mature OIDC clients, review the threat model, and test locally with deterministic synthetic identities.