Enterprise auth was the single most common line item blocking a deal from closing. It's done, and it wasn't glamorous, but it was necessary.

Nobody writes excited blog posts about SAML. We're writing one anyway, because for a chunk of the teams evaluating Helix, this was the actual blocker between a trial and a signed contract, and it deserves the same care as anything with a flame graph in it.

One config for SAML and OIDC

Rather than build two separate integration paths, Helix now speaks both SAML 2.0 and OIDC through a single identity provider config. Point it at Okta, Azure AD, or Google Workspace and every workspace member authenticates through your existing IdP, full stop — no more shadow local passwords sitting next to your SSO users.

identity_provider:
  type: oidc
  issuer: https://your-org.okta.com
  client_id: 0oa1b2c3d4e5f6g7h8i9
  default_role: viewer
  group_role_map:
    sre-team: editor
    platform-admins: admin

SCIM: provisioning that doesn't lag your HRIS

The harder problem was deprovisioning. Manual offboarding means someone forgets, and an ex-employee keeps dashboard access for weeks. SCIM 2.0 support means Helix accounts are created, role-mapped, and deactivated automatically the moment your identity provider processes the change — the same day someone leaves, not the next audit cycle.

What broke while we built it

Group-to-role mapping was harder than the spec makes it look: identity providers disagree on how nested groups get represented in a SCIM payload, and we rewrote our group resolver twice after early customers hit edge cases with Azure AD's group claim limits. Worth noting for anyone building this themselves.

What we didn't compromise on

A few early design partners asked for a simpler, Helix-specific role model that skipped group mapping entirely and just assigned roles per user, since it would have shipped faster. We said no, because that pattern is exactly what creates the offboarding lag SCIM exists to prevent — a per-user assignment is one more place a departing employee's access can be forgotten. Every role in Helix now traces back to an IdP group, full stop, even though it made the initial rollout for smaller customers slightly more setup than they expected.

  • SAML 2.0 and OIDC through one identity provider configuration
  • SCIM 2.0 user and group provisioning, same-day deprovisioning
  • Group-to-role mapping, so IdP group membership drives Helix permissions
  • Audit log of every provisioning event for compliance review