How does SSO work with multiple client SSO servers?

[dan]

If you use FusionAuth to authenticate users of our web-application, but want to offer SSO to Enterprise customers that have their own user databases (such as Azure AD, GSuite), how can you do it?

Social logins (Facebook, Twitter, Github, Google) are one thing, but how do things would work for specific client SSO servers?

How does the login screen know what to show the user? You don't want an SSO button per client implementation.

[dan]

This is generally done by using the domain configuration. For example, all users with an email address domain of acme.com can be configured to use a particular SAML or OpenID Connect configuration.

As soon as you configure one IdP with a domain, the login panel will collect the email address first to understand if we need to ask for a password or forward them along to a federated identity provider.

Read more about managed domains here: https://fusionauth.io/docs/v1/tech/identity-providers/openid-connect/