One front door for every tool you run
Most SaaS platforms let you enforce that your staff sign in through your own identity provider instead of the platform's built-in passwords or social login. When that IdP is Obelisk, you stop managing a separate login for every tool — and you raise the floor on all of them at once: phishing-resistant passkeys, a live security posture, and a tamper-evident receipt for every passage.
Be the IdP for your stack. Federate Cloudflare, 1Password, and Microsoft Entra over OIDC, and GitHub, Google Workspace, AWS, Slack, Atlassian and more over the SAML 2.0 IdP. One identity, every tool.
Two protocols, one audited IdP
Obelisk speaks both federation standards, so it can be the IdP for almost any platform you run:
- OpenID Connect provider. Discovery at
/.well-known/openid-configuration, public keys at/.well-known/jwks.json, tokens signed ES256 with automatic JWKS rotation. Any platform with a generic OIDC connector federates to Obelisk with three URLs and a client. Prefer OIDC wherever it's offered — the config is shorter and key rotation is automatic. - SAML 2.0 Identity Provider. Obelisk issues signed SAML
Responseassertions to downstream service providers. Metadata (SSO URL + X.509 signing certificate) is published at/saml/idp/metadata; the sign-on endpoint is/saml/idp/sso. Assertions are signed RSA-SHA256 with a pinned X.509 certificate — tamper-rejecting by construction. This unlocks every SAML-only platform below.
For an OIDC platform you exchange a client_id + client_secret + redirect URI one way and Obelisk's issuer + endpoints the other. For SAML, the platform shows you its ACS URL and Entity ID; you point it at Obelisk's IdP SSO URL, issuer, and certificate. Full SAML setup guide →
Connector catalogue
Thirteen of the platforms security-led teams ask for most. Readiness reflects the live surface: OIDC connectors work against Obelisk today; the SAML platforms are reachable now that the SAML 2.0 IdP ships — bringing each one live is per-platform configuration, not new code.
| Platform | Protocol | Readiness | Notes |
|---|---|---|---|
| Cloudflare | OIDC or SAML | OIDC ready now | Free on every plan — the priority win. Federate dashboard sign-in today. |
| 1Password | OIDC | OIDC ready now | OIDC-only, Authorization Code + PKCE. Business / Enterprise. |
| Microsoft Entra (External ID) | OIDC or SAML | OIDC ready now | OIDC federation works today; scope it as partner / guest access. |
| GitHub / GitHub Enterprise | SAML | SAML ready | Org- or enterprise-level SAML SSO for your engineering org. |
| Google Workspace | SAML | SAML ready | Third-party IdP SSO profile, scoped to OUs or groups. |
| AWS IAM Identity Center | SAML | SAML ready | External SAML IdP — free with any AWS account. |
| Slack | SAML | SAML ready | Business+ / Enterprise Grid, HTTP-POST binding. |
| Atlassian (Jira / Confluence) Guard | SAML | SAML ready | Via Atlassian Guard; domain verification required. |
| Vercel | SAML | SAML ready | Pro & Enterprise team SSO. |
| Zoom | SAML | SAML ready | Needs an approved vanity URL before SSO. |
| Notion | SAML | SAML ready | Business or Enterprise; a single IdP per org. |
| Figma | SAML | SAML ready | Organization / Enterprise; org admins configure. |
| Datadog | SAML | SAML ready | Enterprise plan and above; signed assertions, POST binding. |
Per-platform plan tiers, domain-verification requirements, and exact console field labels are documented per connector — confirm them in each platform's admin UI before go-live.
A sensible rollout order
The lowest-cost, highest-credibility wins come first because they're already live over OIDC:
- Cloudflare Dashboard SSO (OIDC) — free on every plan, works today, zero new code.
- 1Password (OIDC) — OIDC-only and ready now; a strong security-buyer signal.
- Microsoft Entra External ID (OIDC federation) — live today for partner / guest access.
- Everything SAML — GitHub, Google Workspace, AWS, Slack, Atlassian, Vercel, Zoom, Notion, Figma, Datadog — each a config exchange against the SAML 2.0 IdP.
Next steps
Ready to federate? Add Obelisk as your SAML IdP · Integrate Obelisk into your own app · How federation is secured · Create your account. Running at scale and want help wiring a specific platform? Talk to us.