Question 2Integrations and APIs
How would you set up single sign-on for a large customer?
SSO (SAML or OAuth/OIDC) is a common first task in enterprise deals and a common source of delays.
“Hands-on with APIs, webhooks, authentication (OAuth, SSO) and data integrations”Forward Deployed Engineer · Harmony
The answerFour steps
- 1
Confirm their identity provider (Okta, Entra ID, Google) and protocol
Say it like this
“My first call is with their identity team: which IdP, Okta or Entra ID, and SAML or OIDC.”
Why it scores
Starts with the people who own the timeline, then the protocol.
- 2
Exchange metadata and test in a staging tenant first
Say it like this
“We swap metadata, entity ID, ACS URL and signing certificate, and test in a staging tenant with five test users before touching production.”
Why it scores
Names the real setup pieces and tests in staging. Sounds like someone who has done it.
- 3
Map user groups to roles in your product
Say it like this
“Then we map their groups to our roles: “Finance-Approvers” in Okta becomes our approver role, sent as a group attribute in the assertion.”
Why it scores
Roles come from their groups, so their IT manages access, not you.
- 4
Plan for user removal: what happens when someone leaves the company
Say it like this
“And I ask how people get removed. SAML only checks at login, so I'd set up SCIM, and a leaver loses access the same day instead of when their session runs out.”
Why it scores
Thinks about leavers. Security reviewers ask this, and most candidates forget it.
StrongAll together
About a minute, out loud. The marked parts are the four steps; hover one to find it above.
My first call is with their identity team: which IdP, Okta or Entra ID, and SAML or OIDC.1 That team often has a two-week change queue, so I ask early. We swap metadata, entity ID, ACS URL and signing certificate, and test in a staging tenant with five test users before touching production.2 Then we map their groups to our roles: “Finance-Approvers” in Okta becomes our approver role, sent as a group attribute in the assertion.3 And I ask how people get removed. SAML only checks at login, so I'd set up SCIM, and a leaver loses access the same day instead of when their session runs out.4
WeakThe answer that fails
Sounds fine. Common. Scores low.
“I'd use a library like Passport or Auth0, add a “Sign in with SSO” button, configure OAuth with their provider, and test that login works.”
Interviewer's note
Only covers login. Nothing on their identity team, roles, staging, or people who leave.
PracticeTwo minutes, then they push back
Your turn
How would you set up single sign-on for a large customer?
Answer like you're in the room: about two minutes, no notes. Say it out loud, even alone. It feels different from thinking it. Then check your answer against what interviewers score.