Stop writing custom SAML XML parsers for every enterprise client. Connect Okta, Microsoft Entra ID, Google Workspace, JumpCloud, PingFederate, and any OASIS SAML 2.0 provider in minutes through our 100% Stateless RAM proxy.
Full SAML 2.0 SP and IdP-initiated authentication flow with dynamic group attribute extraction and instant X.509 PEM signature verification.
NameID & groups ➔ Unified JWT email & roles[]
Seamless Enterprise Application SAML toolkit support with automatic Microsoft WS-Federation claim URI normalization into clean JSON fields.
.../identity/claims/emailaddress ➔ Unified JWT email
Custom SAML App integration with verified Google Workspace primary email, first/last name, and department organizational unit mapping.
PrimaryEmail & FirstName ➔ JWT email & given_name
Zero-friction cloud directory SAML 2.0 connector with multi-group assertion support and hosted SP Metadata XML auto-configuration.
email & memberOf ➔ Unified JWT email & roles[]
High-assurance enterprise federation compatibility engineered for regulated banking, financial, and healthcare organizations.
SAML_SUBJECT & mail ➔ Unified JWT sub & email
Universal compatibility with any standard SAML 2.0 Identity Provider exporting an Entity ID, Single Sign-On URL, and X.509 PEM Certificate.
urn:oid:... or NameID ➔ Unified JWT email & roles[]
Click any Identity Provider below to see how KyoRox transforms provider-specific SAML 2.0 XML assertions into a single deterministic JSON Web Token in volatile RAM.
// 1. Okta Workforce SAML 2.0 Input Entity ID : http://www.okta.com/exk91a7f8c2 SSO URL : https://acme.okta.com/app/sso/saml Protocol : OASIS SAML 2.0 HTTP-POST Binding // Provider-Specific XML Attributes: NameID : alice.vance@acme-corp.com firstName : "Alice" lastName : "Vance" groups : ["Engineering-Admins"] Signature : RSA-SHA256 (X.509 PEM Verified)
/auth/sso/{YOUR_TENANT_UUID}/acs
// Deterministic Application JWT (Identical Across All IdPs)
{
"iss": "https://sso.kyorox.com",
"sub": "alice.vance@acme-corp.com",
"email": "alice.vance@acme-corp.com",
"given_name": "Alice",
"family_name": "Vance",
"roles": ["Engineering-Admins"],
"idp": "okta",
"tenant_id": "{YOUR_TENANT_UUID}",
"iat": 1762320000,
"exp": 1762320300
}
https://your-app.com/callback?access_token=...
Because KyoRox converts complex SAML 2.0 XML handshakes into a standard RFC 7519 HS256 JSON Web Token, you can verify enterprise logins in any language without installing brittle XML libraries.
Verify the returned access_token query parameter using standard jsonwebtoken or jose with your 256-bit tenant secret.
Eliminate python3-saml and C-level xmlsec1 binary dependencies. Decode and verify KyoRox tokens natively with PyJWT.
Validate high-throughput enterprise SSO callbacks in microseconds using standard golang-jwt/jwt/v5 HMAC-SHA256 verification.
Drop KyoRox into any Laravel or Symfony middleware route and verify enterprise SAML users with firebase/php-jwt.
Replace heavy Spring Security SAML2 or WS-Federation XML configs with lightweight Nimbus JOSE + JWT or JwtSecurityTokenHandler.
Authenticate enterprise buyers in Rails or Actix/Axum Rust services using standard ruby-jwt or jsonwebtoken crates.
Every identity provider follows the exact same deterministic setup flow inside the KyoRox Customer Control Plane.
Sign in to the KyoRox Control Plane and copy your isolated Service Provider Entity ID and Assertion Consumer Service (ACS) URL—or send your hosted OASIS SP Metadata XML link directly to your customer's IT administrator.
Your enterprise customer pastes your SP URLs into Okta, Microsoft Entra ID, Google Workspace, JumpCloud, or PingFederate and shares their IdP Entity ID, Single Sign-On URL, and public X.509 Signing Certificate (.pem).
KyoRox validates incoming SAML assertions in volatile RAM (<15ms, 0 bytes on disk) and redirects authenticated employees to your whitelisted allowed_redirect_uris with a short-lived, cryptographically signed HS256 JWT.