My company wants me to build an engine that will store SSO IDP’s details like login url, client key, client secret and any other field required for SSO login. All the details should be stored in the database and the information should be collected from the client using the dashboard. I cannot configure the details in settings.py file.

As in when a client company of ours wants to implement SSO, all the should do is login to the dashboard, go to a specific screen and enter the fields mentioned above and or any required fields that I would need to setup the SSO.

Also I cannot configure the SSO details in settings.py as the credentials will be added by the client. So this has to be outside the scope of settings.py file.

The SSO login url given by the client will be used for SSO redirection and the user should be authenticated from there.

My issue is that my company does not want to configure the SSO for each individual client based on their need but rather use the engine so that the client company can set up SSO on their own without our interference. I have discussed potential cybersecurity threats and limitations but I still want an opinion or suggestion if this is doable and if yes any solution on how to approach the problem would be helpful.

I tried to create a model that will store the data from the client and have built a middleware to reroute to the SSO login page if the user selects SSO login. But I feel that storing sensitive information like client key and secret key in the DB is a bad idea. I would like to know if there are any other ways to do this, and I would also like to know if at all this is possible. Thanks in advance.