SAML 2.0 single sign-on

Bring your own SAML identity provider. Users sign in through your IdP and are JIT-provisioned into deny.sh on first login. Every login is recorded in the audit chain.