Skip to content

M9-12 Additional Identity/Transport Protocol Support — SAML 2.0 & TLS 1.3

Milestone: M9 — Hardening and Compliance SOW Reference: NFR3, Appendix 6 Supported Standards Requirement Clarity: ✅ Clear Dev Status: ❌ Not started — confirmed gap in the current codebase (OAuth2.0/OIDC via Auth0 exist; no SAML library or endpoints anywhere; TLS termination not configured in application code)

Overview

NFR3 requires the system to integrate with "standard identity protocols such as OAuth2.0, SAML 2.0, OpenID Connect" and Appendix 6 explicitly lists SAML 2.0 ("Enterprise Single Sign-On support") and HTTPS/TLS 1.3 as supported standards. OAuth2.0/OIDC are already covered via Auth0 (M2-07); SAML 2.0 and TLS 1.3 are not yet addressed anywhere.

Tasks

  • Reconcile a conflicting prior finding first: M9-00's security audit (dated 2026-04-15, "S2") marked SAML 2.0 as "✅ Done (Auth0)," but the later, more thorough codebase review found no SAML library or endpoints anywhere. This likely means SAML would be delivered as an Auth0 Enterprise Connection (dashboard configuration) rather than application code — confirm whether that satisfies the requirement, or whether dedicated SAML endpoints/testing are expected.
  • Confirm with Curo whether SAML 2.0 SSO is actually required for MVP, or only OAuth2.0/OIDC via Auth0 (the SOW lists SAML as a supported standard but no specific staffing company has been named as requiring it)
  • If required: add SAML 2.0 SSO support (e.g. via Auth0's SAML connector, or a dedicated library)
  • Confirm TLS 1.3 termination is correctly configured at whichever layer handles it (load balancer/API gateway, once the AWS hosting decision is made) — this is an infrastructure configuration item, not application code, but needs explicit verification and sign-off

Dependencies

Acceptance Criteria

  • Encryption in transit verified (TLS 1.3) (per SOW Appendix 3, Security Testing — SAML has no explicit standalone criterion, worth adding once scope is confirmed)

Existing Reference Material

None.

Blockers & Risks

  • Needs decision: whether SAML 2.0 is genuinely required for MVP or just listed as a supported-standards aspiration.