SSO App Catalog
Entra ID as IdP — apps onboarded with SAML or OIDC, and how users are provisioned.
| App | Protocol | Provisioning | Status |
|---|---|---|---|
| AWS IAM Identity Center | SAML | SCIM (Entra → AWS) | Live lab |
| Cloudflare Access (intranet) | SAML | SCIM (Entra → CF) | Live Lab |
| FinFlow SCIM SaaS (03) | — | SCIM target (lab) | Lab |
Architecture
The SCIM server is a SaaS stand-in for lifecycle demos — not a hub in front of AWS.
Path A — IdP outbound
Entra ──SAML+SCIM──► AWS IAM Identity Center
Entra ──SAML + SCIM──► Cloudflare Access → internal.alanvpv.dev
Path B — Custom JML
HR stub ──► Orchestrator ──► Entra (Graph)
└──SCIM──► 03-scim-server (lab SaaS)