FluxyChatSecurity
SAML SSO
How FluxyChat verifies SAML assertions on the Worker when SSO is on.
FluxyChat can verify SAML responses from your IdP on the Worker. The dashboard page is Settings → Identity. The Worker module is sso-saml.js.
This is not a click-through IdP wizard. You still configure the IdP (Okta, Azure AD, Google) and paste ACS URL, entity ID, and certificate into the Worker secrets / identity settings.
What the Worker checks:
- XML signature on the assertion
- Audience and recipient match your tenant ACS
- Assertion is not expired
- NameID (or configured attribute) maps to a FluxyChat user
Turn it on only after JWT auth works. SSO sits on top of the same rooms and member tokens.
Related: Auth JWT, Production setup, Agent tool exfiltration.