FreeSCIM Federation | SAML and OIDC Trust Control

Parallel protocols, one operating model

SAML

SP initiation, MFA handoff, ACS validation, assertion checks, claims, role mapping, logout, readiness, and failure evidence.

OIDC relying party

Discovery, JWKS validation, authorization-code flow, state, nonce, PKCE, scopes, group claims, role mapping, and sessions.

OIDC broker

Registered applications, clients, signing keys, authorization codes, token records, and controlled federation handoff.

Federation operations

Provider catalog, protocol health, topology, sessions, drift, replay evidence, policy state, and diagnostics.

Security controls

OIDC issuer, redirect URI, discovery, JWKS, state, nonce, PKCE, scopes, and claim strategy are explicit readiness checks.
SAML and OIDC failures retain request and correlation context without exposing assertions, tokens, cookies, client secrets, or private keys.
Authentication events remain separate from SCIM provisioning and SSWS-style provider intelligence.
Protocol enablement can be governed by environment and operator policy without removing the implemented capability.

Federation is observable

Successful and failed starts, callbacks, role decisions, session establishment, logout, protocol health, and suspicious patterns all feed the same operator-readable evidence model.