Developer Reference

Identity & SSO

Sarthi HR authenticates every vendor/contractor session through our SAML 2.0 identity provider. Your application never sees a password — only a signed assertion.

Assertion shape

After a successful login, the IdP POSTs a SAML <Response> to /saml/acs. The single identity claim the application reads is the <Subject>/<NameID> element, formatted as an email address:

<saml:Subject>
  <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
    you@your-company.com
  </saml:NameID>
</saml:Subject>

Everything else in the assertion (session index, issue instant, audience restriction) is used for protocol bookkeeping; account identity is resolved entirely from this one value.

Endpoints

Path	Method	Purpose
`/signup`	POST	Create a vendor account (email, password, company)
`/login`	GET	Begin SP-initiated SSO (redirects to the IdP)
`/saml/acs`	POST	Assertion Consumer Service — the IdP posts the signed assertion here
`/saml/metadata`	GET	This app's SP metadata (entity ID, ACS URL, NameID format)
`/dashboard`	GET	Your vendor dashboard — scoped to the NameID on your session

Tech stack

Python, Flask, python3-saml on the application side; SimpleSAMLphp as the identity provider.