Workforce SSO for the tools your team actually uses.

One sign-on, every internal app. WeldForge federates against the directory you already run (LDAP, Active Directory, Google Workspace), speaks SAML 2.0 and OIDC to every vendor that matters, and enforces MFA by tenant policy — so your admins spend less time maintaining identity glue and more time on the problems worth solving.

Set up workforce SSO See the audit trail

What it solves

The realities of a growing company's internal IT: the HR system lives in one CRM, finance in another, engineering uses ten SaaS products, and you've accumulated a half-dozen places a password can leak. Workforce SSO is the fix.

Federation

SAML & OIDC to everything

Register each vendor as a Service Provider once; users log in to your WeldForge portal and step into every app without a second prompt. Per-SP attribute release policies keep claim surface minimal.

LDAP / AD upstream

Keep your existing directory as the source of truth. WeldForge binds on login, verifies the password against the directory, and provisions a local shadow automatically — complete with break-glass fallback to a local admin if the directory is unreachable.

Provisioning

SCIM 2.0 in both directions

Okta, Entra, Workday or Rippling can push employees in via SCIM on day one and deactivate them instantly on day last. Group memberships drive roles automatically through configurable group-to-role mappings.

MFA

Policy-driven MFA

Require TOTP, WebAuthn, SMS OTP or backup codes — or several — per tenant or per role. Step-up MFA for high-assurance apps (admin consoles, production deploys) without rewriting the apps themselves.

RBAC

Admin role separation

Four built-in admin roles: SUPER_ADMIN across every tenant, TENANT_ADMIN within one, READ_ONLY for auditors, and NONE for everyone else. Role changes invalidate outstanding tokens immediately.

Session control

Tenant-specific TTLs

Access tokens from 1 minute to 30 days per tenant. Custom JWT claims injected server-side. RP-initiated logout works on every downstream app that implements the standard.

How it fits together

A typical workforce deployment looks like this:

Your AD / LDAP stays where it is. WeldForge queries it, never replaces it.
Each SaaS vendor gets registered as a Service Provider with its ACS URL and certificate.
Users hit an internal portal, authenticate once (directory password + MFA), then click through to apps.
Every authentication emits an audit event, which feeds your SIEM via the webhook stream.
Admins manage tenants, SPs, MFA policies and users from a single Angular console.

Break-glass by design If your LDAP is unreachable WeldForge automatically falls back to local passwords for users that have them. A locked-out sysadmin with a local account can always get in — even if the directory is on fire.

Quick start

curl -X POST https://sso.example.com/api/admin/saml/service-providers \
     -H "x-app-authorization: wf_live_..." \
     -H "Content-Type: application/json" \
     -d '{
        "entityId": "https://app.example.com/saml/metadata",
        "name": "Internal Wiki",
        "acsUrl": "https://app.example.com/saml/acs",
        "nameIdFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
        "encryptAssertions": true,
        "spCertificate": "-----BEGIN CERTIFICATE-----\n..."
     }'

More step-by-step walkthroughs are on the tutorials page.