Explain how SSO with SAML or OIDC works and what can go wrong on launch day.

Summary

The user authenticates at the customer's identity provider, which sends a signed assertion (SAML) or ID token (OIDC) to your app; you validate signature, issuer, audience and time window, then map groups to roles. Launch-day failures: clock skew rejecting assertions, wrong audience or certificates, unmapped group names leaving users without roles, and no break-glass admin to fix it.

Longer Answer

Test with the customer's real IdP and groups in staging, allow a small skew with NTP everywhere, use SCIM for provisioning, roll out by group, and keep a vaulted local admin.

Key Points

• Assertion/token validation.
• Group-to-role mapping.
• Clock skew and certificates.
• Test with real IdP; break-glass.

Deep dive: Forward Deployed Engineering in Practice: Locked Out on Launch Day

What interviewers look for

Practical SSO knowledge beyond the acronyms.