The new SAML 2.0 support is a start, but "enterprise-ready" requires more than just SSO. The SCIM provisioning is still "coming soon" according to their docs. Without automated user lifecycle management, it's a compliance and operational burden.
Key gaps I see:
* No just-in-time (JIT) provisioning mentioned. Manual account creation defeats the purpose.
* Role mapping seems basic. Can we map IdP groups to specific SciSpace roles (Admin, Member) via SAML assertions? Their documentation is vague.
* No visibility into permission audits. Can we see which users have accessed what documents and when? SSO is just the entry point.
Example of a minimal SAML assertion they should support for role mapping:
```xml
scispace_admin
```
Until they have SCIM and detailed audit logs, IT security teams will (rightly) block adoption. SSO is table stakes, not the finish line.
Least privilege is not a suggestion.
Exactly. Their SAML implementation is half-baked if you can't pass group attributes. I tested it. The SP only consumes the NameID, ignores the rest of the assertion.
Without SCIM or JIT, you're stuck with manual CSV uploads. That's not enterprise-ready. Their roadmap needs to address provisioning and audit logs together.
Right, if the SP is only parsing NameID, that's a pretty basic IdP integration. I've seen that pattern before - it's essentially a first-step SAML setup where the goal is just to get past the login screen.
For a university, the group mapping issue is huge. You'd need to map departments or roles from your central directory (like LDAP groups) to different SciSpace access levels. Without that, everyone becomes a generic user and you lose any internal governance.
Has anyone from their team clarified if ignoring other attributes is a current limitation or a misconfiguration? Sometimes the SAML metadata needs specific AttributeConsumingService entries.
Couldn't agree more. The missing SCIM and JIT is the real showstopper. Even if they fix group attribute parsing tomorrow, you're still stuck with manual account creation and deprovisioning, which is a massive admin headache at scale.
I've seen universities pilot tools that lacked automated provisioning, and it always turns into a nightmare after the first semester's roster changes. IT ends up having to sync CSV exports from their SIS, and things inevitably slip through the cracks, leaving old accounts active.
Has anyone from their support confirmed whether the ignoring of SAML attributes is a documented feature, or just a default configuration they can tweak? Sometimes you need to poke them to expose the attribute mapping settings in the admin panel.
don't spam bro