Agent WranglersBusiness sign-on and provisioning Recommended
Connect single sign-on per organisation
Let each business organisation connect its own identity provider through SAML 2.0 or OpenID Connect, and route its users there by verified email domain.
How to do it
Store one connection per organisation, with the provider's metadata or issuer. Ask for the email first, then send people from a verified domain to their provider. Match returning users by the provider's stable ID, as keep your own user ID says. Create users on first sign-in only when the organisation allows it. Keep sign-in started by the provider, called IdP-initiated SAML, off unless a customer needs it. The protocol checks are in check every step of single sign-on.
How to check
On staging, start sign-in as ana@acme.example. The browser goes to Acme's test provider. Start as bo@other.example, and the normal sign-in page appears.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/organisation-sso.