SAML 2.0 identity provider

What the SAML provider is

SenseCrypt is a SAML 2.0 identity provider (IdP).

Your app trusts SenseCrypt as the SAML IdP.

SenseCrypt authenticates the enrolled person by face.

The sign-in stays passwordless.

• —SAML 2.0 single sign-on (SSO).
• —Passwordless sign-in by face.
• —One IdP for many service providers.
• —Standard SAML assertions for your app.

How SAML sign-in works

Your app redirects the user to SenseCrypt.

The user signs in by face.

Face matching runs on-device.

SenseCrypt signs a SAML assertion.

Your app validates the assertion, then grants access.

• —The service provider trusts the SAML IdP.
• —The user signs in by face.
• —SenseCrypt returns a signed assertion.
• —Your app maps the user to a role.

What you get

You get passwordless SSO for SAML apps.

SenseCrypt adds RBAC and multi-tenant isolation.

SenseCrypt writes audit logs for each sign-in.

Your users get one face login for all apps.

• —SAML 2.0 SSO across your apps.
• —Role-based access control (RBAC).
• —Multi-tenant isolation.
• —Audit logs for each event.

How it fits the standard

SenseCrypt follows SAML 2.0.

It acts as the identity provider (IdP).

Your service provider connects with standard metadata.

SenseCrypt also supports OIDC, OAuth 2.0, SCIM 2.0, and CIBA.

• —SAML 2.0 with signed assertions.
• —Standard SP metadata for setup.
• —SCIM 2.0 for user provisioning.
• —OIDC, OAuth 2.0, and CIBA also.

How to turn it on

You start with a 30-day free trial.

The trial needs no card.

You add your app as a SAML service provider.

Pricing is one dollar per user per month, flat.

• —Start a 30-day free trial, no card.
• —Exchange SAML metadata with SenseCrypt.
• —Map SAML attributes to user roles.
• —Pricing is one dollar per user per month.