I've been evaluating LangGraph's enterprise SSO support for a potential deployment. The marketing page lists SAML 2.0 and SCIM, which is the expected baseline. However, a compliance checkbox on a datasheet doesn't equate to a well-integrated, secure implementation.
My preliminary audit of their documentation and a trial tenant reveals several points that need verification:
* **IdP-initiated vs. SP-initiated flow:** Both are documented, but the SP-initiated flow's reliance on a unique user identifier needs clarity. Is it immutable? How are changes handled?
* **Just-in-Time (JIT) provisioning:** It's present, but the attribute mapping appears limited. I need to see if role/group claims from the IdP are properly consumed and mapped to internal permissions.
* **SCIM implementation depth:** Does their SCIM API fully support `PATCH` operations for group membership, or is it just user `CREATE`/`DELETE`? Partial support creates drift and manual overhead.
* **Audit trail correlation:** Are SSO authentication events captured in the platform's admin audit logs with the correct IdP session identifiers? This is non-negotiable for incident response.
Has anyone performed a full integration with Okta, Azure AD, or PingFederate in a production environment? I'm specifically looking for details on:
* Any custom claim requirements beyond the standard.
* How access revocation at the IdP is propagated (timing, logged actions).
* Whether their system respects the SAML `SessionNotOnOrAfter` attribute for session timeouts.
Where is your SOC 2?