SSO App Catalog
Entra ID/Okta as IdPs — apps onboarded with SAML or OIDC, and how users are provisioned.
| App | Protocol | Provisioning | Status | Write-up |
|---|---|---|---|---|
| AWS IAM Identity Center | SAML | SCIM (Entra → AWS) | Live lab | GitHub |
| Cloudflare Access (intranet) | SAML (Entra); OIDC (Okta) | SCIM (Entra → CF); SSO only (Okta) | Live lab | GitHub |
| Grafana Cloud | OIDC | JIT (first login) | Live lab | GitHub |
| FinFlow SCIM SaaS (03) | — | SCIM target (lab) | Lab | Docs |
Architecture
The SCIM server is a SaaS stand-in for lifecycle demos — not a hub in front of AWS.
Path A — IdP outbound
Entra ──SAML+SCIM──► AWS IAM Identity Center
Entra ──SAML + SCIM──► Cloudflare Access → internal.alanvpv.dev
Okta ──OIDC (SSO)──► Cloudflare Access → internal.alanvpv.dev
Entra ──OIDC (JIT)──► Grafana Cloud
Path B — Custom JML
HR stub ──► Orchestrator ──► Entra (Graph)
└──SCIM──► 03-scim-server (lab SaaS)