How do I test SSO before a customer goes live?

To test SSO before a customer goes live, set up a pre-production SSO flow that mirrors production as closely as possible, then verify both the identity provider (IdP) and your app are configured correctly.

Recommended approach

1) Use a staging or sandbox environment

Create a non-production version of your app with:

• A separate URL/domain if possible
• Non-production certificates and secrets
• Test users only

This lets you validate SSO without affecting real customers or real logins.

2) Configure the customer’s IdP for staging first

Ask the customer to create an SSO app/integration in their IdP for your staging environment:

• SAML: upload your staging ACS URL / Entity ID, and import their IdP metadata
• OIDC/OAuth: register your staging redirect URI(s), client ID, and client secret

Use test users or a test group in the customer’s directory.

3) Test the full login flow

Verify:

• User can click “Sign in with SSO”
• Redirect goes to the IdP
• Authentication succeeds
• User returns to your app
• The account is created/linked correctly
• Roles/groups/claims are mapped as expected

4) Test common failure cases

Confirm behavior for:

• Unknown user
• Disabled user
• Missing required group/claim
• Expired session
• Wrong email/domain
• Duplicate user mapping
• Logout / session timeout behavior

5) Validate with both IdP- and SP-initiated flows

If supported, test:

• SP-initiated: user starts in your app
• IdP-initiated: user starts from the IdP portal

Some customers only use one of these in production, but testing both catches configuration issues early.

6) Check logs and SSO assertions

Inspect:

• SAML assertions or OIDC tokens
• Audience / issuer / recipient values
• Signature validation
• Clock skew / time validity
• Attribute/claim names and formats

This is often where pre-launch issues show up.

7) Run a UAT sign-off

Before go-live, have the customer confirm:

• The right users can sign in
• The right users are blocked
• Attribute mapping is correct
• JIT provisioning or SCIM behaves correctly if used
• SSO works from the expected entry points

Best practice checklist

• Staging app configured
• Test IdP integration created
• Test users/groups assigned
• SSO login succeeds end-to-end
• Attribute/claim mapping verified
• Logout/session tested
• Error scenarios validated
• Customer approves UAT

If you want the safest rollout

Use a phased launch:

1. Test in staging
2. Whitelist a small pilot group in production
3. Monitor logs
4. Expand to all users

If you tell me whether you’re using SAML or OIDC, and which IdP (Okta, Azure AD/Entra, Google, OneLogin, etc.), I can give you a more specific test plan and checklist.