The SAML parser must reject dangerous input without locking legitimate enterprise users out.
Assertion safety protects privileged access, while compatibility protects active SSO deployments.
Who you’d be doing this for
“Our security lead asked why an analyst landed in an admin route, and I don’t have a clean answer yet.”
Serkan Noori · Platform Engineer
Owns identity integration for a SaaS application that uses SAML SSO and JWT role claims.
What is at stake
A small number of SAML users receive JWT roles that do not match their identity-provider assignment. You must weigh a durable parser and migration change against the risk of disrupting live enterprise access.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- privilege containment vs. SAML compatibility
- rapid containment vs. durable parser behavior
- fleet migration safety vs. security urgency
- strict rejection rules vs. diagnosable developer failures
Why Supabase
SAML SSO is part of the authentication surface application teams rely on for enterprise access.
Written with these in mind
Not your kind of problem? 23 more at Supabase, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.