Security & Identity - SSO / IdP Federation is where ERP discipline either begins or breaks.
SSO / SAML 2.0 and OIDC Identity Provider Integration looks operational from far away. In a real finance team, it is a chain of assertions: the right actor started the work, the required records existed, the control policy was applied, the state change was preserved, and the outcome can be explained later without rebuilding the transaction from emails and spreadsheets.
The expected business outcome is specific: Employees log in once through corporate IdP; IT controls access centrally; offboarded employees lose Rivane access within one IdP sync cycle.
The control flow a finance team actually needs.
Step 1
SAML 2.0 And OIDC Authorization Code +...
Step 2
IdP Metadata Refresh On Configurable...
Step 3
Attribute Mapping Is Configurable Per IdP
Step 4
Just-In-Time Provisioning Creates The...
Step 5
Force-SSO Mode Disables Password Login...
The ERP surface involved.
Module
Security & Identity - SSO / IdP Federation
Actors
IT Administrator, End-Users, Identity Provider (Okta / Azure AD / Google Workspace)
Tier
Tier 2
Finance area
Platform, Integration, Security, Administration & Analytics
Region lens
US and UK finance teams
Publication date
June 18, 2026
Support SAML 2.0 (HTTP-POST and HTTP-Redirect bindings) and OIDC Authorization Code + PKCE; IdP metadata refresh on configurable schedule (default 24 h); attribute mapping is configurable per IdP (e.g., map `groups` claim to Rivane roles); Just-In-Time provisioning creates the Rivane user account on first SSO login; force-SSO mode disables password login for the org; JWT access TTL ≤15 min regardless of IdP session length; SSO login events written to audit log; support ≥10 concurrent IdP configurations per org.
US and UK teams have different compliance hooks, but the same control problem.
US teams usually care about clean evidence for audit support, vendor records, payment controls, tax reporting, and management review. UK teams usually care about VAT-ready records, approval evidence, digital-record discipline, and traceable postings. The country-specific details differ, but the operating pattern is the same: the ERP needs controlled records, explicit ownership, defensible state changes, and evidence that survives beyond the person who completed the task.
The control matrix.
| Control area | Requirement | Acceptance proof |
|---|---|---|
| Control 1 | Support SAML 2.0 (HTTP-POST and HTTP-Redirect bindings) and OIDC Authorization Code + PKCE | Given an org with SAML 2.0 IdP configured |
| Control 2 | IdP metadata refresh on configurable schedule (default 24 h | when a user initiates SSO login and the IdP returns a valid signed SAML assertion, then Rivane validates the signature, maps attributes to roles, mints a JWT with ≤15-min TTL, and the user is logged in |
| Control 3 | | when the IdP returns an assertion with an invalid signature, then login is rejected with 401 INVALID_ASSERTION |
| Control 4 | Just-In-Time provisioning creates the Rivane user account on first SSO login | negative) when force-SSO mode is enabled and a user attempts password login, then 403 SSO_REQUIRED is returned. |
| Control 5 | force-SSO mode disables password login for the org | Employees log in once through corporate IdP; IT controls access centrally; offboarded employees lose Rivane access within one IdP sync cycle. |
| Control 6 | JWT access TTL ≤15 min regardless of IdP session length | Employees log in once through corporate IdP; IT controls access centrally; offboarded employees lose Rivane access within one IdP sync cycle. |
Audit evidence is a chain, not a folder.
| Evidence layer | What should be preserved |
|---|---|
| Business event | IT Administrator registers the IdP in Rivane by uploading the SAML metadata XML or configuring the OIDC discovery URL. Rivane validates the signing certificate and stores the configuration per organization. Users click "Sign in with SSO," are redirected to the IdP, authenticate (with MFA enforced at the IdP), and return with a signed assertion. Rivane validates the assertion signature, maps IdP attributes to Rivane roles via a configurable attribute map, and mints a short-lived JWT. Sessions created via SSO cannot be extended without re-authenticating at the IdP. |
| Control rules | |
| Acceptance proof | Given an org with SAML 2.0 IdP configured; when a user initiates SSO login and the IdP returns a valid signed SAML assertion, then Rivane validates the signature, maps attributes to roles, mints a JWT with ≤15-min TTL, and the user is logged in; when the IdP returns an assertion with an invalid signature, then login is rejected with 401 INVALID_ASSERTION; (negative) when force-SSO mode is enabled and a user attempts password login, then 403 SSO_REQUIRED is returned. |
| Data record | |
| System event | |
| Lifecycle state | |
The useful version of this workflow is not only fast. It is inspectable. A controller, auditor, or operator should be able to move from source event to system record to state transition to final business outcome without guessing.
Implementation contracts.
Reference data model
`idp_config` { idp_id: string, org_id: string, protocol: enum(SAML2,OIDC), metadata_url: string, attribute_map: jsonb, status: enum(ACTIVE,INACTIVE), external_id: string }; `sso_session` { session_id: string, user_id: string, idp_id: string, authn_at: timestamp, idp_session_id: string }; `audit_event` { event_id: string, action: string(SSO_LOGIN), actor_id: string, outcome: string, timestamp: timestamp }; (reference, product may differ).API and events
`POST /v1/auth/sso/saml/callback` { SAMLResponse } -> 302 with session cookie; `POST /v1/auth/sso/oidc/callback` { code, state } -> 200 { access_token, expires_in }; `POST /v1/idp-configs` { protocol, metadata_url, attribute_map } -> 201 { idp_id }; `GET /v1/idp-configs/{idp_id}`; emits `auth.sso_login_success` and `auth.sso_login_failed` events; idempotent via `external_id`.State transitions
`PENDING_VERIFICATION -> ACTIVE`; terminal `INACTIVE`; guard: JWT TTL ≤15 min regardless of IdP session length; metadata refresh on configurable schedule; force-SSO blocks password login path.Common implementation traps.
Treating the workflow as data entry
If the ERP only stores the final record, the team loses the decision trail that explains how the record became valid.
Hiding exception logic
Exceptions need owners, reason codes, and time stamps. A vague pending state is not a control.
Posting without recovery design
Retries, duplicate submissions, and partial failures must be explicit so the system does not create inconsistent records.
Skipping evidence design
A workflow that cannot produce evidence on demand will eventually push finance teams back into manual screenshots and spreadsheets.
Where Rivane fits.
Rivane is built for finance workflows where automation must stay tied to source documents, approvals, state transitions, ledger impact, reporting, and audit evidence. Use this guide as a checklist for evaluating whether an ERP workflow is merely digitized or actually controlled.
References and source basis.
These sources provide the standards, regulatory, or government context around the flow. They are included so the guide is useful to finance operators, auditors, and implementation teams, not only buyers reading software copy.