I’m building a SaaS app and want Google sign in plus enterprise SSO

Absolutely — for a SaaS app, the cleanest approach is usually:

1. Google Sign-In for individual users
2. Enterprise SSO for company customers via SAML and/or OpenID Connect (OIDC)

Recommended architecture

1) Use one identity layer in your app

Have all auth routes flow through a single auth service in your backend:

• POST /auth/google
• POST /auth/sso/saml/acs
• GET /auth/sso/oidc/callback

This keeps user creation, session issuance, role assignment, and org linking consistent.

2) Support two login paths

Google Sign-In

Good for:

• smaller teams
• self-serve signup
• users with Gmail / Google Workspace

Typical flow:

• User clicks “Continue with Google”
• Google returns identity info
• You create or link the user account
• You issue your own session/JWT

Enterprise SSO

Good for:

• larger organizations
• IT-managed users
• compliance/security requirements

Typical enterprise protocols:

• SAML 2.0: still very common in enterprise
• OIDC: newer, simpler, and often easier if the customer supports it

Usually:

• customer admin configures their IdP (Okta, Azure AD / Entra, OneLogin, Google Workspace, Ping, etc.)
• you store their IdP config per organization
• users authenticate and get mapped to an org

Best-practice setup for SaaS

Org-based auth model

Structure users like this:

• users
• organizations
• memberships
• identity_providers
• auth_identities

This lets one user:

• belong to multiple orgs
• use Google for one org
• use enterprise SSO for another

Account linking rules

Decide how to match identities:

• by verified email
• by org domain
• by explicit invitation
• by admin-approved linking

For enterprise SSO, usually:

• SSO login is tied to a specific org
• email domain can help route users to the right org
• avoid auto-linking without verification in sensitive apps

Implementation options

Fastest path: use an auth provider

If you want to ship quickly, use:

• Auth0
• WorkOS
• Clerk
• Firebase Auth (better for consumer/simple auth than enterprise SSO)
• Supabase Auth (limited enterprise SSO compared with dedicated providers)
• Zitadel / Keycloak if you want more control

For SaaS with enterprise SSO, WorkOS is a very common choice because it’s built for:

• SAML
• OIDC
• directory sync
• organization-based auth
• domain discovery

Build it yourself

Possible, but more work:

• Google OAuth/OIDC is straightforward
• SAML is significantly more complex
• you’ll need certificate handling, metadata exchange, assertion validation, clock skew handling, logout considerations, and more

If enterprise SSO is important, many teams:

• build Google login themselves
• use a provider for SAML/OIDC enterprise SSO

Suggested user flow

1. User enters email
2. You detect domain:
   • if personal email → show Google login or email/password
   • if company domain → check if org has SSO enabled
3. If SSO exists:
   • redirect to SSO
4. If not:
   • continue with Google sign-in
5. After auth:
   • create session
   • resolve org membership
   • redirect to app

Security considerations

• Always verify Google tokens server-side
• Use secure, HTTP-only cookies for sessions if possible
• Enforce email verification
• For SSO, validate audience, issuer, signature, and expiration
• Support SCIM later if enterprises want automated user provisioning/deprovisioning
• Add audit logs for login events

My practical recommendation

If you want the least risk and fastest launch:

• Google Sign-In: OAuth/OIDC directly or via your auth provider
• Enterprise SSO: WorkOS/Auth0/Clerk enterprise features
• Your app: own org/user/session management

If you want, I can also help you with one of these next:

1. a recommended tech stack
2. a database schema
3. a login flow diagram
4. code examples for Google + SAML/OIDC in your backend