Security Specification

Enterprise Single Sign-On (SAML 2.0 & OIDC)

Oridio Enterprise provides native Single Sign-On (SSO) federation using SAML 2.0 and OpenID Connect (OIDC). By delegating authentication to your centralized identity provider (IdP), security teams enforce multi-factor authentication (MFA), conditional access policies, and automated lifecycle deprovisioning across all agent swarms and workspaces.

Supported Protocols:SAML 2.0, OIDC (PKCE)
Directory Provisioning:SCIM 2.0 RFC 7644
Enforcement Mode:Strict Domain Lockdown

Core Architecture & Flow

When a user initiates authentication, Oridio acts as the Service Provider (SP). If Strict SSO Enforcement is enabled for your organization domain, standard password and generic social logins are blocked, redirecting users through your identity provider.

  1. SP Initiation: User requests access via Oridio Console or CLI. Oridio identifies the domain and sends an encrypted SAML AuthnRequest to your IdP SSO endpoint.
  2. Authentication & MFA: Your IdP evaluates conditional access, checks device health, enforces hardware MFA (FIDO2 / WebAuthn), and authenticates the user.
  3. Signed Assertion: The IdP posts a signed SAML 2.0 assertion containing claims (email, name, groups, roles) to Oridio’s ACS URL.
  4. Cryptographic Validation: Oridio validates the XML digital signature against your uploaded X.509 certificate, confirms timestamp freshness, and issues a scoped cryptographic session JWT.

Identity Provider Setup Guides

🔵

1. Okta SAML 2.0 Configuration

In your Okta Admin Console, navigate to Applications > Create App Integration > SAML 2.0. Configure the following parameters:

Single Sign-On (ACS) URL: https://api.oridio.dev/v1/auth/sso/saml/acs
Audience URI (SP Entity ID): urn:oridio:sp:{your_workspace_id}
Name ID Format: EmailAddress
Application Username: Email

Under Attribute Statements, add: email = user.email, firstName = user.firstName, lastName = user.lastName, and role = user.oridioRole. Download the IdP Metadata XML and paste it into Oridio Settings.

🟦

2. Microsoft Entra ID (Azure AD)

In the Microsoft Entra admin center, go to Identity > Applications > Enterprise applications > New application > Create your own application. Select Integrate any other application you don't find in the gallery.

Identifier (Entity ID): urn:oridio:sp:{your_workspace_id}
Reply URL (ACS URL): https://api.oridio.dev/v1/auth/sso/saml/acs
Sign-on URL: https://oridio.org/login

Under Attributes & Claims, ensure the Unique User Identifier (Name ID) is set to user.userprincipalname. Download the Federation Metadata XML and upload it to Oridio.

🔴

3. Google Workspace Enterprise

In the Google Admin console, go to Apps > Web and mobile apps > Add app > Add custom SAML app. Name the app "Oridio Agent Security Runtime".

ACS URL: https://api.oridio.dev/v1/auth/sso/saml/acs
Entity ID: urn:oridio:sp:{your_workspace_id}
Name ID Format: EMAIL

SCIM 2.0 Automated User Provisioning

Oridio supports SCIM 2.0 (System for Cross-domain Identity Management) conforming to RFC 7643 and RFC 7644. When employees join, change teams, or leave your organization, your IdP pushes updates to Oridio in real-time, instantly revoking API tokens and access rights.

SCIM 2.0 Endpoint Configuration
SCIM Base URL: https://api.oridio.dev/v1/scim/v2
Authentication Method: OAuth 2.0 Bearer Token
Supported Operations: CreateUser, UpdateUser, DeactivateUser, SyncGroups

Zero-Downtime Certificate Rotation

SAML X.509 signing certificates expire every 1 to 3 years. Oridio supports multi-certificate dual-signing rollover. You can upload the secondary certificate up to 30 days before expiration. The runtime will accept signatures matching either certificate, ensuring 100% uptime during key rollover ceremonies.

Installation & Setup

Oridio can be integrated either as a drop-in HTTP proxy without modifying your agent codebase, or via our official language bindings for programmatic telemetry and fine-grained Wasm triggers.

$pip install oridio-python && npm install @oridio/sdk
Step 1: Set Proxy Base URL

Route OpenAI/Anthropic SDK client requests through https://proxy.oridio.org/v1.

Step 2: Add Auth Header

Supply your Oridio Master Key via header X-Oridio-Auth: ord_live_....

Architecture & Deep Dive

The Oridio security runtime operates as an out-of-band Layer 7 data plane. Rather than relying on non-deterministic LLM-as-a-judge prompts, security constraints are compiled into Ahead-Of-Time (AOT) WebAssembly binaries evaluated at bare-metal speeds.

Near-Native Wasm
< 0.7ms

P50 evaluation overhead per token packet.

Fail-Closed SLA
99.99%

Global Anycast edge proxy availability.

State Locking
Redlock

Distributed Redis mutex for swarms.

Zero Egress Leakage Guarantee: When a policy trips or a prompt injection signature is detected, Oridio severs the network socket instantly before any data traverses to the upstream provider.

Sample Code & Implementation

from oridio import OridioClient
from langgraph.graph import StateGraph

# Initialize Oridio Edge Gateway client
client = OridioClient(api_key="ord_live_7x9k2m...")

# Wrap your state graph with zero-trust proxy
graph = StateGraph(AgentState)
secure_graph = client.wrap_graph(
    graph,
    budget_limit_usd=50.00,
    pii_redaction=True,
    anomaly_detection=True
)

Interactive Runtime Playground

Edge Mode: Active
{"agent": "finance-bot", "query": "Transfer SSN 000-12-3456"}
{"agent": "finance-bot", "query": "Transfer SSN [REDACTED_SSN]"}(0.7ms p50)

Frequently Asked Questions

Oridio compiles security policies into Ahead-of-Time (AOT) WebAssembly running directly on global proxy edge nodes. Standard regex and token evaluation adds less than 1 millisecond (p50: 0.7ms, p99: < 5ms).

Need help integrating?

Our runtime engineering team can help pair on your agent topology.

Contact support@oridio.org
Previous (Enterprise VPC)PrivateLinkNext (Observability) OTLP Tracing