What this integration does
SenseCrypt acts as the SAML identity provider (IdP). Your SAML application acts as the service provider. The application redirects users to SenseCrypt to sign in. SenseCrypt returns a signed SAML assertion. The assertion confirms the enrolled user.
- SenseCrypt is the SAML identity provider (IdP).
- Your application is the SAML service provider.
- The integration uses open standards, not a proprietary connector.
- Users sign in with face login.
How the standards flow works
SenseCrypt publishes a SAML 2.0 metadata file. The file lists the sign in URL and the signing certificate. Your service provider imports this metadata file. Your application exports its own metadata file to SenseCrypt. Both sides then trust each other.
- SenseCrypt metadata lists the SSO URL and certificate.
- SenseCrypt signs each SAML assertion with its key.
- The assertion carries the user identifier and attributes.
- Your service provider validates the signature.
Setup steps
You download the SenseCrypt metadata file. You import the file into your application. You export your application metadata to SenseCrypt. The face match runs on-device during sign in. SenseCrypt stores no biometric data on the server.
- Download the SenseCrypt metadata file.
- Import the metadata into your service provider.
- Send your service provider metadata to SenseCrypt.
- Map the SAML attributes to your user profile.
- Test the sign in flow.
What you get
Your users get passwordless sign in. Face login uses no password and no shared code at sign in. Each sign in binds to the device. This binding makes the flow phishing-resistant. You keep your existing SAML application. You add strong authentication through a metadata file.
- Passwordless sign in for every user.
- Phishing-resistant authentication with no password or shared code to enter at sign in.
- On-device face match keeps biometric data off the server.
- Standard SAML attributes for your application.
Frequently asked questions
Does SenseCrypt need a proprietary SAML connector?
No. SenseCrypt uses standard SAML 2.0. Both sides exchange metadata files. This is standards-based federation.
How do both sides establish trust?
Each side imports the other metadata file. The metadata carries the signing certificate. SenseCrypt signs every SAML assertion.
Where does the face match run?
The face match runs on-device. SenseCrypt stores no biometric data on the server. It uses patent-pending face tokenization.
Can SenseCrypt provision users too?
Yes. SenseCrypt supports SCIM 2.0 for user provisioning. It also supports OIDC, OAuth 2.0, and CIBA.
Related