The Enterprise Customer

The story

The Halvard Group ran occupational-health clinics for industrial employers — nine sites, eleven hundred staff, and a procurement process with the warmth of a customs inspection. They wanted Meridian’s platform. Their security questionnaire wanted 240 answers, and two of the rows were bolded: employees must sign in through our identity provider, and when we terminate someone, their access must end without your involvement.

Ana had lost a deal to those rows before, in her previous job. SAML had a reputation in her head: a protocol from 2005 with XML signatures, a fifteen-year CVE lineage, and consultants who charged accordingly. SCIM she knew mostly as an acronym that appeared next to SAML on pricing pages, on the tier called “Contact us”.

This time both were already in the box. She registered Halvard’s IdP as a connection: metadata, entity ID, and — the part Sentinel is opinionated about — the signing certificate, pinned per connection and verified through a second channel with Halvard’s IT lead, because the library validates what’s configured and refuses to let the document vouch for itself. Assertions run a validation ladder — one top-level assertion, issuer, destination, audience, conditions windows with bounded clock skew, replay cache — and the signature check compares the signed element to the consumed element by reference equality, which is the sentence that ends the whole signature-wrapping CVE genre. IdP-initiated SSO stayed off, the default, and Halvard’s engineers approved of being told no.

Provisioning was the quieter revelation. Halvard’s Entra tenant got a SCIM token for Meridian’s SCIM endpoints; new hires appeared with memberships and role mappings before their first shift, and terminations vanished the same hour HR clicked the button — no CSV, no Friday sync job, no ticket queue. Ingrid Solberg, Meridian’s auditor, asked the question she always asks — “who turns them off when they leave?” — and for the first time the answer was their own HR system, automatically, with an event trail.

The questionnaire took an afternoon. The deal took a quarter, but it was the lawyers’ quarter, not Ana’s.

Why this is hard the traditional way

Enterprise SSO is a checkbox that unpacks into a protocol stack. SAML’s XML-DSig model — sign an element, reference it by ID — has produced fifteen years of signature-wrapping vulnerabilities, and most of them shipped in libraries, written by people who read the spec carefully. Getting it right means pinned keys, algorithm allowlists, transform allowlists, DTD prohibition, replay caches, and a consumption path that provably uses the element the signature covered. Getting it almost right means an attacker who can be any employee, including the ones with admin.

Deprovisioning is the compliance half. Without SCIM, offboarding is an email to a vendor — which means terminated employees keep access for the latency of a human process, and your customer’s auditor writes that sentence down. Building a SCIM server means users, groups, PATCH semantics, filter parsing, and bearer-token hygiene: a second identity API, with its own security surface, that only exists to serve your biggest customers.

How Sentinel changes the ending

Both acronyms are packages, not projects. The SAML side speaks both directions — Meridian is an SP toward Halvard’s IdP, and could be an IdP for a partner tomorrow — with the paranoid parts non-optional: every enveloped signature funnels through one verification path with its five layers, and the test suite stages the classic attacks (wrapped assertions, substituted certificates, DOCTYPE payloads, replayed assertions) and asserts each one dies. The SCIM server mounts as endpoint groups with hashed bearer tokens, mapping inbound users into the same realm/org/role model the rest of the season built — a Halvard hire is just a user with memberships, evaluated by the same engine as everyone else.

The strategic shift is who does the integration work. Enterprise identity stopped being a bespoke consulting engagement per customer and became configuration: a connection record, a token, a domain verification. The second enterprise customer took a morning.

What it costs you to ignore this

• The deals you lose are the biggest ones. SSO/SCIM rows are pass/fail; “on our roadmap” reads as “no” to a procurement team.
• A SAML implementation that’s 95% right is 0% right. The missing 5% is precisely where the CVE class lives.
• Manual deprovisioning is a standing finding. Every terminated employee with live access is a line in your customer’s audit, attributed to you.
• Per-customer integration glue compounds. Ten enterprise customers × bespoke SSO scripts is a team you didn’t plan to hire.