Outbound SSO
Single Sign-On that allows users to access external apps using their home organization's credentials.
What is Outbound SSO?
Outbound SSO allows users from your organization to access external applications using their home organization credentials. Your IdP (Identity Provider) sends SAML assertions or OIDC tokens to external Service Providers.
Outbound SSO flow:
- User: From your organization (employee, partner)"
- "Home IdP: Your identity system (Okta, Azure AD, LoginRadius)"
- "External SP: Third-party app (Salesforce, Workday, Concur) that trusts your IdP"
This is the traditional SSO use case - your employees accessing third-party SaaS applications with their corporate credentials.
Analogy
Think of outbound SSO like a university student ID. The student uses their university ID (home IdP) to access the library, gym, and cafeteria (external SPs) at partner universities when visiting. They use their home credentials for external services.
Types and Use Cases
- "Employee SSO: Employees use corporate credentials to access Salesforce, Slack, Workday"
- "B2B Portals: Your partners use their corporate IdP to access your vendor portal"
- "Partner Ecosystem: Consultants use their firm's IdP to access client portals"
- "CIAM: Your customers use LoginRadius to access third-party SaaS apps"
How it Works
{
"outboundSSO": {
"identityProvider": "https://idp.company.com",
"serviceProviders": [
{
"name": "Salesforce",
"entityId": "https://salesforce.com",
"protocol": "saml2.0",
"spMetadataUrl": "https://salesforce.com/metadata"
},
{
"name": "Slack",
"entityId": "https://slack.com",
"protocol": "openid-connect",
"clientId": "1234567890"
}
],
"userProvisioning": "scim",
"deprovisioning": "automatic"
}
}Outbound SSO vs Inbound SSO
Outbound SSO
Inbound SSO
Outbound SSO: Your users access external apps (Salesforce, Slack) with your IdP
Inbound SSO: External users (partners, customers) access your apps with their IdP
Outbound = your employees going out
Inbound = external users coming in
Best Practices for Outbound SSO
- "Automate provisioning: Use SCIM to auto-create/update users in SPs"
- "Monitor usage: Track which SPs your users access (security visibility)"
- "Deprovision automatically: When employee leaves, disable access to all SPs via SCIM"
How LoginRadius Powers Outbound SSO
LoginRadius CIAM platform provides outbound SSO to 100+ pre-configured SaaS applications (Salesforce, Slack, Workday, Concur) via SAML 2.0 and OpenID Connect. Our platform provides SCIM provisioning to auto-create/update users in external SPs, a pre-built app catalog with step-by-step guides, and custom app support for any SAML/OIDC-compliant service provider. LoginRadius also provides outbound SSO analytics and detailed audit logs.
FAQs
Outbound SSO: Your users (employees) access external apps (Salesforce, Slack) using your IdP. Inbound SSO: External users (partners, customers) access your apps using their IdP. Outbound = users going out; Inbound = users coming in.
Steps: (1) Configure IdP: Set up SAML/OIDC in your IdP (Okta, LoginRadius), (2) Configure SP: In Salesforce, add your IdP as SSO provider, (3) Exchange metadata: Share SAML metadata between IdP and SP, (4) Test login: Have user click 'Login with SSO' in Salesforce, (5) Enable SCIM: Auto-provision users from IdP to Salesforce.
LoginRadius enables outbound SSO: (1) As IdP: Connect to 100+ SaaS apps (Salesforce, Slack, Workday) via SAML/OIDC, (2) SCIM provisioning: Auto-create/update users in external SPs, (3) App catalog: Pre-configured connectors for popular SaaS apps, (4) Custom apps: Connect to any SAML/OIDC-compliant SP, (5) Analytics: Track which external apps your users access.