KAIRO Global Fintech
KAIROGlobal Fintech
SSO · Readiness

SAML 2.0 / OIDC integration readiness

What we'd need to wire kgfbuilds.dev as a relying party to a third-party Identity Provider — for example MyDigital ID (Malaysia), UK GOV.UK One Login, Azure AD, Okta, or a partner bank's IdP.

Honest status

No production SSO is live. Possessing an IdP's integration guideline PDF (e.g. MyDigital ID v5.0) is not the same as being an onboarded relying party — every gov / enterprise IdP rejects connections from clients it has not provisioned and allow-listed. This page tracks what is needed if/when onboarding is granted.

SAML 2.0

  • SP Entity ID

    https://kgfbuilds.dev/sso/saml/metadata (proposed; not yet registered with any IdP)

  • ACS (Assertion Consumer Service) URL

    https://kgfbuilds.dev/sso/saml/acs — endpoint not yet implemented

  • SLO (Single Logout) URL

    https://kgfbuilds.dev/sso/saml/slo — endpoint not yet implemented

  • SP X.509 signing certificate

    Generate with openssl, register fingerprint with IdP.

  • SP metadata XML

    Generated from the above once cert is issued.

  • IdP metadata XML (from agency)

    Provided by the IdP after onboarding approval.

  • Allow-listed redirect URIs registered with IdP

    IdP-side configuration; depends on agency provisioning.

  • Attribute mapping agreement (NRIC / email / name)

    Negotiated per agency; documented in the IdP's integration guideline.

  • Signed integration agreement / MoU with the IdP

    Hard pre-requisite. No agreement = no test environment access.

OpenID Connect

  • client_id

    Issued by the IdP after relying-party registration.

  • client_secret (or private_key_jwt)

    Stored as Lovable Cloud secret once issued.

  • Discovery URL (.well-known/openid-configuration)

    Published by the IdP.

  • Redirect URI registered with IdP

    Proposed: https://kgfbuilds.dev/sso/oidc/callback

  • Scopes agreed with IdP

    Typically openid profile email; agency-specific scopes vary.

See sub-processors and certifications at /trust · controller statement at /legal/data-controller.