Ory Polis Identity Federation and SAML-to-OIDC Bridge

The identity federation engine that bridges legacy SAML to modern OIDC and adds SCIM directory sync — so your B2B and B2B2C SaaS app speaks one protocol while accepting every enterprise IdP. Federate with any SAML 2.0 provider through a single API.

Identity federation is the protocol layer behind Enterprise SSO — and it's typically where B2B SaaS engineering teams lose months to SAML edge cases. Ory Polis handles the federation problem in days, not months.

Need support?

Ory Polis is available via Ory Enterprise License: self-hosted control + 24x7 support.

Need to move quickly?

Get the power of Ory Polis fast and easily via the Ory Network. Sign up for free!

Identity federation for B2B SaaS apps

Ory Polis handles the protocol layer behind every Enterprise SSO integration — SAML, OIDC, and SCIM — so your engineering team ships the federation features your enterprise customers contractually require without becoming SAML experts.

SAML-to-OIDC federation

Federate SAML identity providers through a single OIDC integration in your app. Polis translates SAML assertions, attribute mappings, and metadata into the OAuth 2.0 / OIDC tokens your existing auth stack already understands. From first line of code to production in days.

Self-service IdP onboarding

Enterprise IT admins configure their own identity provider connections through branded, secure self-service portals — no engineering ticket per customer, no per-partner SAML XML editing. New enterprise customers go from contract signing to production federation in minutes.

SCIM directory sync

SCIM 2.0 provisioning synchronizes accounts and groups from corporate directories automatically. When an admin adds a user in their IdP, that user appears in your B2B SaaS app without manual administration — through the same unified federation API.

SAML-to-OIDC federation

Self-service IdP onboarding

SCIM directory sync

Ahmed Elkaffas

Founder

Seamless Enterprise SSO integration with the customer's existing infrastructure, and minimal effort from the customer side, was very important for us.

Read the Effortless Solutions' identity federation case study

Ory Polis identity federation feature set

Multi-tenant organizations
Group customer organizations within your B2B SaaS, manage their federation connections independently, and enforce domain-based authentication that routes users to their organization's IdP.
OIDC single sign-on
Establish OpenID Connect (OIDC) federation connections per organization, configurable through Ory Console or API. Polis's OIDC federation is the same protocol your existing OAuth-based auth stack already speaks.
SAML identity provider support
Federate with every major SAML-based identity provider — Microsoft Entra ID, Microsoft ADFS, Okta, Auth0, Google Workspace, Ping Identity, JumpCloud, and any SAML 2.0–compliant IdP. Polis handles the protocol differences so your app never has to.
SAML to OIDC bridge
The SAML-to-OIDC bridge is Polis's structural differentiator — cross-protocol identity federation that translates legacy SAML into modern OIDC tokens. Your app uses one protocol (OIDC) while accepting connections from every enterprise IdP, regardless of what protocol they speak.
Identity provider discovery and routing
Route users to their organization's federation IdP automatically based on email domain. Eliminates the 'choose your SSO provider' selection step that adds friction at the login UX layer.
Flexible federation deployment
Deploy Polis where your data residency, compliance, or sovereignty requirements take you — self-hosted, private cloud, on-premises, air-gapped, or fully-managed on Ory Network. The deployment flexibility no SaaS-only federation vendor offers.

How to de-risk identity at scale with Ory

OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.

Ory Open Source

Evaluation and prototyping

Continuous Security License

Guaranteed, SLA-backed CVE patching year-round

Ory Enterprise License

Self-hosted, great for enterprises that require greater control (e.g. certified or air-gapped environments, and regulated industries)

Ory Network

Fully-managed, fastest path to production without operational overhead

Cross-platform benefits

Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)

Compliance-ready

Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)

Global multi-region architecture

Multi-region capable

Global multi-region architecture

Purpose-based data retention

24/7 SLA support

CVE security patching

Unified control plane for ease of management

CLI

Unified control plane for ease of management

CLI

Unified control plane for ease of management

CLI / GUI

Unified control plane for ease of management

CLI / GUI / Terraform provider

Software Bill of Materials

Cryptographic Bill of Materials (CBOM) & Artificial Intelligence Bill of Materials (AIBOM)

Production Helm Charts

n/a

Managed infrastructure

n/a

Managed infrastructure

Support Ticketing System

Concierge onboarding

Dedicated slack channel

Premium Features

B2B Federation - Ory Polis

Custom Branding for Onboarding Portal

SAML & OIDC

Directory sync

Identity federation

Managing Identities - Ory Kratos

High performance pooling

B2B Organizations

Admin onboarding portal

Social single sign-on

Purpose-based data retention

CAPTCHA

FedCM

Advanced identity search

Authorization (Certified OAuth2/OIDC) - Ory Hydra

OAuth 2.0 + OpenID Connect with OAuth 2.1 support*

OpenID Certified®

High performance pooling

Stateless JWT access tokens

Credential rotation

Token exchange

Resource Owner Password Credentials (ROPC)

Permissions - Ory Keto

Concierge Onboarding

Optimized Permission Checks

OPA & RAG Integration

Ory Polis FAQ

What is Ory Polis?

Ory Polis is an open-source enterprise Single Sign-On (SSO) service for SAML and OIDC identity providers. It abstracts the complexity of the SAML and OIDC protocols by presenting them as a standard OAuth 2.0 flow. It is available as open-source software, under the Ory Enterprise License for self-hosted production, and as part of the fully managed Ory Network.

What business benefits does Ory Polis provide?

Accelerated Time-to-Market - Ory Polis transforms months of complex SAML/OIDC engineering into a few days of work. By using a "SAML-to-OIDC bridge," developers can integrate enterprise SSO using a familiar OAuth 2.0 flow rather than learning legacy protocols.
Reduced Sales Friction - Polis provides a self-service configuration portal. This allows your enterprise customers' IT teams to set up their own SSO connections and identity providers (like Okta, Azure AD, or Google Workspace) without needing manual support from your engineering team.
Automated User Management - Through Directory Sync (SCIM 2.0), Ory Polis automates the provisioning and de-provisioning of users. When an employee leaves a client’s company, their access to your app is automatically revoked, ensuring security and reducing administrative overhead.
Flexible Data Residency - Unlike "black box" identity providers, Ory Polis offers deployment flexibility. Businesses can choose to host it themselves to meet strict data residency requirements or use the fully managed Ory Network.

What problem does Ory Polis solve?

SaaS companies serving enterprise customers often need to support SAML-based SSO so employees can log in with their corporate identity provider (Okta, Azure AD, Google Workspace, etc.). Implementing SAML from scratch requires specialized protocol expertise and months of engineering effort. Ory Polis eliminates that burden. You integrate with Ory Polis using familiar OAuth 2.0 or OIDC libraries, and Ory Polis handles the SAML/OIDC protocol translation behind the scenes. This reduces implementation time from months to days.

How does Ory Polis work?

Ory Polis acts as a SAML-to-OIDC bridge. When your enterprise customer's IT admin configures their SAML identity provider, they upload the IdP metadata to Ory Polis. Ory Polis generates an OAuth 2.0 client for that connection. When a user signs in, your application initiates a standard OAuth 2.0 authorization flow against Ory Polis. Ory Polis redirects the user to their corporate identity provider, handles the SAML assertion, and returns an OAuth 2.0 access token to your application. Your code never touches SAML XML directly.

Does Ory Polis support both SAML and OIDC identity providers?

Yes. Ory Polis supports SAML and OIDC identity providers. Enterprise customers can connect their existing corporate IdP regardless of which protocol it uses. Ory Polis presents both as a unified OAuth 2.0 flow to your application.

Does Ory Polis support directory sync (SCIM)?

Yes. Ory Polis supports SCIM-based directory synchronization for automated user provisioning and deprovisioning. When an employee is added or removed in the corporate directory, the changes are synchronized to your application automatically. Guided setup is available for common directory providers. You can build SCIM endpoints into your application using the Ory Polis library, or run Ory Polis as a standalone service that handles the SCIM webhook lifecycle for you.

Does Ory Polis support multi-tenancy?

Yes. Ory Polis takes a multi-tenant approach by design. Each SSO connection is scoped to a tenant and product pair. A tenant identifies your customer (by email domain, account ID, or similar identifier), and a product identifies which of your applications the connection applies to. You can manage multiple SSO connections for multiple customers from a single Ory Polis instance.

How do I integrate Ory Polis with my application?

Ory Polis supports two integration modes. First, as a standalone service: you deploy Ory Polis as a separate process (Docker container, Kubernetes deployment, etc.) and interact with it over HTTP APIs. This mode includes an Admin Portal UI for managing SSO and directory sync connections. Second, as an embedded npm library: if your application runs on Node.js, you can embed Ory Polis directly into your application code. This avoids managing a separate service but does not include the Admin Portal UI out of the box.

How does Ory Polis relate to Ory Kratos?

Ory Kratos handles identity management: login, registration, MFA, sessions, and user profiles. Ory Polis handles enterprise SSO federation: bridging your application to corporate SAML/OIDC identity providers. They are complementary. On the Ory Network, Ory Polis capabilities are integrated into the platform alongside Ory Kratos. When self-hosting, you can run both as separate services.

Why Ory for your IAM?

Ory Polis delivers a "deploy-anywhere" IAM platform designed for trillion-scale performance and architectural flexibility. Seamlessly manage and secure customers, partners, and AI agents without the risk of vendor lock-in. With Ory’s modular building blocks, you consolidate identity infrastructure, lower TCO, and bring mission-critical applications to market faster through automated, high-scale governance.

Does Ory Polis include self-service onboarding for enterprise IT admins?

Yes. Ory Polis provides self-service configuration portals where your enterprise customers' IT administrators can set up their own SAML/OIDC connections and directory sync without needing deep protocol expertise. This reduces the coordination overhead between your team and your customers' IT departments.

Is Ory Polis free? How does pricing work?

Ory Polis open source is free. You can self-host it at no cost.On the Ory Network, Ory Polis capabilities are included as part of the platform. B2B SSO features are available on the Growth plan and above. Enterprise plans are custom-priced.For self-hosted production with SLAs, CVE patching, and enterprise features, the Ory Enterprise License is available at custom pricing.

Deploy Ory Polis on your preferred infrastructure

Deploy on any infrastructure and take full control over your organizational and enterprise customer SSO.

Integrate Ory Polis with your stack

View all integrations

Integrations

Ready to try Ory Polis?

Get started with the guides and docs below

Documentation Quickstart Guide Download Product Brief

AuthProvider.tsx

...
  const signIn = async () => {
    // store the from url before redirecting ... we need this to correctly initialize the oauthClient after getting redirected back from SSO Provider.
    localStorage.setItem(APP_FROM_URL, from);
    // Initiate the login flow
    await authClient?.fetchAuthorizationCode({
      tenant,
      product,
    });
  };

  const signOut = async (callback: VoidFunction) => {
    authClient?.reset();
    setUser(null);
    callback();
  };

More on Ory Polis

View all Ory Polis blogs

November 10, 2025

Announcing Ory OSS v25.4.0

The Ory OSS v25.4.0 release rollout is underway. Discover how Ory’s new unified, calendar-based versioning streamlines upgrades and compatibility across Hydra, Kratos, Keto, and Oathkeeper.

SAML SSO: The Non-Negotiable Key to B2B SaaS Enterprise Revenue

July 10, 2025

Why SAML SSO is non-negotiable for modern B2B SaaS apps

If your platform lacks support for SAML Single Sign-On (SSO), you could already be losing deals without realizing it. SAML isn't a relic of the past; it’s a direct pathway to enterprise revenue.

Introducing Ory Polis for Enterprise SSO

May 29, 2025

Ory Acquires BoxyHQ: Introducing Ory Polis for Enterprise Single-Sign On

In a strategic move set to modernize the identity and access management landscape, Ory has acquired BoxyHQ and launched Ory Polis. Ory Polis addresses organizational identity needs across environments reliant on SAML and SCIM protocols. Previously known as BoxyHQ's Jackson, brings enterprise-ready single sign-on (SSO), directory synchronization, and self-service onboarding to organizations requiring robust B2B and B2B2C identity infrastructure.

March 26, 2024

How Effortless Solutions managed multi-tiered client needs with BoxyHQ (now Ory) SSO

Discover how Effortless Solutions expertly navigated multi-tiered client needs using Ory SSO, achieving seamless integration and enhanced security.

Ory Polis Identity Federation and SAML-to-OIDC Bridge

Need support?

Need to move quickly?

Identity federation for B2B SaaS apps

SAML-to-OIDC federation

Self-service IdP onboarding

SCIM directory sync

SAML-to-OIDC federation

Self-service IdP onboarding

SCIM directory sync

Ory Polis identity federation feature set

Multi-tenant organizations

OIDC single sign-on

SAML identity provider support

SAML to OIDC bridge

Identity provider discovery and routing

Flexible federation deployment

How to de-risk identity at scale with Ory

Ory Polis FAQ

Deploy Ory Polis on your preferred infrastructure

Open Source

Ory Enterprise License

Ory Network

Integrate Ory Polis with your stack

Amazon SES

AWS API Gateway

AWS Infrastructure

Discord Social Login

Ready to try Ory Polis?

More on Ory Polis

Announcing Ory OSS v25.4.0

Why SAML SSO is non-negotiable for modern B2B SaaS apps

Ory Acquires BoxyHQ: Introducing Ory Polis for Enterprise Single-Sign On

How Effortless Solutions managed multi-tiered client needs with BoxyHQ (now Ory) SSO

Try Ory today Start for free