Marketplace and catalog listings
LumoAuth is not currently listed in the identity catalogs or cloud marketplaces below. Each listing has hard technical prerequisites, and this page records, per catalog, which of them LumoAuth meets today and which it does not, so that you can judge how LumoAuth fits a procurement or integration review. Submission steps, partner accounts and marketing assets are outside the scope of the product documentation.
What LumoAuth already has
Capabilities every catalog below draws on:
| Capability | Where |
|---|---|
| SAML 2.0 service provider (consume an enterprise IdP) | SAML SP |
| SAML 2.0 identity provider (be the IdP for downstream apps), signed and encrypted assertions, metadata endpoint | SAML IdP, Metadata |
| OpenID Connect provider with the discovery document, PKCE (a one-time secret that protects the sign-in code), pushed authorization requests, CIBA (approval on the user's own device), device authorization, back-channel logout and the FAPI 2.0 profile | OAuth & OIDC |
| OIDC relying party / enterprise IdP federation (Okta, Entra, OneLogin, Ping, JumpCloud, Duo, Google) | Federation |
SCIM 2.0 server (SCIM is the standard for automatic user provisioning): accept provisioning from an IdP at /orgs/{orgId}/api/v1/scim2.0 | SCIM |
| SCIM 2.0 client: provision outbound to Okta, Entra, Google, Slack, GitHub and others | SCIM |
| Dynamic client registration | Client registration |
| Per-organization custom domains, per-organization signing keys, audit logging, webhooks | Organization portal |
Admin API and lumo CLI for configuration as code | Configuration as code |
Everything below assumes a production deployment on a public HTTPS host with a stable custom domain, published privacy policy and support contact.
Okta Integration Network (OIN)
Listing type: SAML 2.0 and/or OIDC application, optionally with SCIM provisioning ("Lifecycle Management").
Prerequisites LumoAuth meets
- SAML 2.0 SP with SP-initiated and IdP-initiated sign-in, signed assertions, and a metadata URL Okta can consume.
- OIDC relying party supporting the authorization-code flow with PKCE.
- SCIM 2.0 server with
/Users,/Groups,/ServiceProviderConfig,/ResourceTypes,/Schemas, filtering, pagination and PATCH, which is the surface Okta's SCIM spec test exercises. - Per-organization endpoints, so one Okta org maps cleanly to one LumoAuth organization.
What the OIN additionally requires from the vendor: an Okta developer (ISV) account, a customer-facing setup guide with screenshots, a support URL, a permanent test organization with non-expiring credentials, a run of Okta's SCIM spec test against a live endpoint, and app icons and marketing copy. None of these are product features.
Microsoft Entra ID app gallery
Listing type: gallery application with SAML 2.0 or OIDC SSO, optionally automatic user provisioning (SCIM).
Prerequisites LumoAuth meets
- SAML 2.0 SP that accepts Entra's assertions, with configurable entity id, ACS URL and signing certificate rollover.
- OIDC relying party for the "sign in with Microsoft" path.
- SCIM 2.0 server compatible with the Entra provisioning service's expectations (
/Users,/Groups, PATCH,filter=userName eq "…", soft-delete viaactive:false). - Bearer-token authentication for the SCIM endpoint, issued and rotatable per organization.
What the gallery additionally requires from the vendor: a Microsoft Partner Center account with a verified publisher profile, a test Entra tenant and test LumoAuth organization for Microsoft's validation team, an end-to-end validation of SCIM against the Entra provisioning service, a draft of the gallery tutorial article, and the list of claims the gallery app manifest should pre-configure.
Google Workspace SAML app catalog
Listing type: pre-integrated SAML app in the Google Admin console.
Prerequisites LumoAuth meets
- SAML 2.0 SP with a fixed, documented ACS URL and entity id pattern per organization.
- Support for Google's signing certificate and the standard
NameIDformats (email, persistent). - Group and attribute mapping from the assertion into LumoAuth roles and groups.
- Outbound SCIM to Google Workspace for the reverse direction, when LumoAuth is the source of truth.
What the catalog additionally requires from the vendor: Google's catalog submission is a partner form rather than a self-service portal, and needs a Google Cloud partner contact, a published setup guide in Google's template, a catalog entry authored as a URL template (LumoAuth's /orgs/{slug}/… shape fits that model), and a test Workspace domain for the reviewer.
AWS Marketplace (SaaS listing)
Listing type: SaaS subscription or SaaS contract, billed through AWS.
Prerequisites LumoAuth meets
- Multi-tenant hosted service with per-organization isolation and self-service organization creation.
- Monthly active users are already metered nightly for Stripe billing (see Billing).
- A SigV4 request signer is already part of the server (used by the CloudWatch and S3 log sinks).
What LumoAuth does not provide: AWS Marketplace billing. There is no registration landing page that exchanges the x-amzn-marketplace-token through ResolveCustomer, no listener for the aws-mp-entitlement-notification / aws-mp-subscription-notification SNS topics, and no BatchMeterUsage reporting. LumoAuth bills through Stripe only; an organization cannot be billed through AWS.
Azure Marketplace (SaaS offer)
Listing type: transactable SaaS offer in the Microsoft commercial marketplace.
Prerequisites LumoAuth meets
- Multi-tenant SaaS with per-organization onboarding.
- Entra ID federation, so a buyer's Entra identity can be used to sign in.
- The same monthly-active-user meter that feeds Stripe.
What LumoAuth does not provide: Azure Marketplace billing. There is no landing page that resolves and activates the marketplace token through the SaaS Fulfillment APIs, no webhook for the fulfillment lifecycle (ChangePlan, ChangeQuantity, Suspend, Unsubscribe, Reinstate), and no metered-billing calls to the marketplace metering API. As with AWS, billing is through Stripe only.
Standards used on this page
| Plain name | Standard |
|---|---|
| SAML 2.0 | OASIS SAML 2.0 |
| OpenID Connect (OIDC) | OpenID Connect Core 1.0 |
| Proof Key for Code Exchange (PKCE) | RFC 7636 |
| Pushed authorization requests (PAR) | RFC 9126 |
| Client-initiated backchannel authentication (CIBA) | OpenID CIBA Core 1.0 |
| Device authorization (sign in on another device) | RFC 8628 |
| Logout | OpenID Connect Back-Channel Logout |
| Financial-grade API (FAPI) 2.0 | FAPI 2.0 Security Profile |
| SCIM 2.0 (user and group provisioning) | RFC 7643 and RFC 7644 |
| Dynamic client registration | RFC 7591 |
See the standards reference for what each one covers and how LumoAuth uses it.