Choose a capability, run one focused demonstration, and inspect what happened.
Inspect Entra ID SAML federation, service-provider metadata, assertion validation, and application authorization.
Entra ID federation validates a signed assertion before any identity reaches application authorization.
This clears your WizardGang session and sign-in flow cookies. Microsoft, Google, and GitHub retain their own sessions.
Sign in
Credentials and protocol secrets stay on the Worker.
Enterprise federation
An Entra enterprise application and signing certificate must be configured before SAML sign-in is available.
The Worker checks the signed assertion, audience, time bounds, and replay before creating a session.
Authenticated
Received → validated
Application contract
Only fields legitimately derived from validated provider data cross this boundary.
Application authorization
Trust evidence