Human SSO

Federated login for PostgreSQL sessions.

The optional SSO path validates SAML or OIDC login, issues a short-lived client certificate, and requires that certificate on the PostgreSQL proxy connection.

Get early access
Review the security model →

Why this exists

Turn an IdP login into verifiable session identity

Safe Boundary supports SAML and OIDC authorization-code connectors. After successful federation, its certificate authority issues a client certificate carrying the subject identity. The proxy validates the Safe Boundary CA, client-auth purpose, expiry, and revocation state.

Administrators can revoke a certificate and cancel active sessions by serial number. This path is optional and must be enabled with secure CA and identity-provider configuration.

What it does

Concrete controls, stated precisely.

SAML or OIDC

Standards-based federation with bounded inputs, response validation, replay defenses, and issuer expectations.

mTLS session binding

The connection presents the issued certificate; its decoded subject attaches to the proxy session.

Revocation and cancellation

Revoke certificate serials and terminate matching active sessions.

Prerequisites

Make the browser-to-mTLS handoff explicit.

  • □Configure a SAML or OIDC authorization-code connector and validate issuer, audience, and response expectations.
  • □Operate the Safe Boundary CA and certificate revocation state as deployment secrets.
  • □Require the issued client certificate on the PostgreSQL proxy connection.
  • □Test expiry, serial revocation, and active-session cancellation before relying on the path.

How it works

A visible enforcement sequence.

  1. Federate

    Configure a SAML or OIDC provider and claim mapping.

  2. Authenticate

    Complete the browser-based provider flow.

  3. Issue

    Receive a short-lived Safe Boundary client certificate.

  4. Connect

    Use mTLS to establish a proxy session bound to that identity.

Protected when

  • ✓Human proxy sessions configured to require Safe Boundary mTLS
  • ✓Expired or revoked Safe Boundary client certificates
  • ✓Active-session cancellation by certificate serial

Important boundaries

  • •SSO is optional, not the default identity behavior of every surface
  • •MCP and PostgREST use different identity and credential mechanisms
  • •IdP lifecycle, group policy, and secure CA operation remain deployment responsibilities

Continue the story

Related Safe Boundary pages

Short-lived sessions →

Understand expiry and revocation without generic JIT claims.

Security model →

Understand trust boundaries, credentials, identity, and bypass conditions.

PostgreSQL wire proxy →

Protect application, ORM, psql, and BI traffic on the PostgreSQL protocol.

Test the boundary on a real access path.

Start in observe mode and validate the policy against representative traffic before you enforce it. That gives the team evidence for each decision, along with explicit bypass controls for the cases that need a deliberate exception.

Get early access