Saml Jackson

The REST API covers SAML SSO connections (CRUD for per-customer SSO configurations), SCIM directory sync connections, and token management. Agents can create SSO connections for new enterprise customers by accepting their SAML metadata, delete connections for offboarded customers, and retrieve connection status. The OAuth 2.0 / OIDC interface abstracts the SAML protocol for downstream application code.

Reliability for self-hosted Jackson is the team's operational responsibility. SAML Jackson is a critical authentication path for enterprise customer logins — high-availability deployment is essential. The stateless design (connection configurations stored in a database) enables horizontal scaling with a shared database backend.

SAML Jackson is the open-source SAML SSO service from BoxyHQ that sits between applications and enterprise SAML identity providers, translating SAML assertions into standard OAuth 2.0 / OIDC tokens. This translation layer means application developers interact with familiar OAuth flows rather than SAML XML parsing and assertion validation. For agents managing enterprise customer authentication setup, the REST API provides programmatic SAML connection management — configuring new customer SSO connections without UI interaction.

Authentication to the Jackson management API uses API keys defined at service startup. The self-hosted deployment model means teams manage the API key infrastructure. Jackson's own authentication to customer SAML IdPs uses the SAML metadata exchange — no additional credentials are required beyond the metadata.

Documentation is clear and developer-focused. The SAML connection setup documentation explains the metadata exchange workflow clearly, which is the primary integration point for agents building enterprise SSO provisioning. Teams evaluating SAML Jackson versus WorkOS or Auth0's enterprise connections for SAML SSO should compare the self-hosted open-source model's control advantages against managed service operational simplicity.