This is a "Performance Purist" architecture designed for extreme throughput and modern reactivity.Because you specifically requested libraries to perform SAML/SSO (acting as a Service Provider) rather than delegating to an external Identity Provider (like Keycloak/Auth0), Go (Fiber) is the recommended backend. The Rust ecosystem for raw SAML handling is currently immature compared to Go's.The High-Performance Reactive StackLayerTechnologySelection / RationaleFrontendSolidJSUses SolidStart (Meta-framework) for SSR and routing. Signals-based reactivity eliminates Virtual DOM overhead.BackendGo + FiberFiber is built on top of fasthttp, the fastest HTTP engine for Go. It matches the "performance" goal better than Gin.DatabaseScyllaDBA drop-in replacement for Cassandra/DynamoDB written in C++. It uses a shard-per-core architecture to handle millions of IOPS.CacheRedisUsed for hot-path caching (session tokens, frequently accessed RBAC policies).1. Architecture OverviewThe application uses a Hexagonal Architecture (Ports & Adapters). The Go backend exposes a REST or gRPC API. SolidJS consumes this via a typed client. Authorization is decoupled into a Policy Engine (PBAC/ReBAC) to prevent spaghetti code.2. Frontend Layer: SolidJSFramework: SolidStart (The "Next.js" of Solid).State Management: Native Signals (createSignal, createStore). No external library (Redux/Zustand) is needed for 90% of cases.Data Fetching: TanStack Query (Solid). Handles caching, deduping, and background refetching of API data.Styling: UnoCSS or Tailwind CSS. Zero-runtime overhead.Authentication Integration (Frontend)Since the backend handles the heavy lifting of SAML/OIDC, the frontend mostly manages the session token.Library: @solid-auth/core (wrapper around Auth.js) or oidc-client-ts (if connecting directly to an OIDC provider).3. Backend Layer: Go (Fiber)This is where the complex requirements (SAML, ReBAC) are handled.A. Authentication (AuthN) - SSO, OIDC, SAMLYou requested libraries to implement this logic directly in your app.SAML (Service Provider): github.com/crewjam/samlWhy: The industry standard for Go. It allows your Fiber app to accept assertions from Okta, Entra ID (Azure AD), or Keycloak.OIDC / OAuth2: github.com/coreos/go-oidcWhy: Maintained by CoreOS, rock-solid validation of ID tokens.Session Management: github.com/gofiber/storage/redisWhy: Stores user sessions in Redis for high-speed retrieval.B. Authorization (AuthZ) - RBAC, ABAC, PBAC, ReBACYou need a system that handles ReBAC (Relationship-based Access Control, e.g., "User is an editor of a folder that contains this document"). Standard RBAC libraries cannot handle this graph-like logic efficiently.Recommendation: OpenFGA (Zanzibar Implementation)Concept: Google Zanzibar is the standard for modern ReBAC. OpenFGA allows you to define a schema (user:bob is viewer of doc:1).Library: github.com/openfga/go-sdkMode: You can run OpenFGA as a sidecar or embedded.Alternative (Policy Engine): OsoLibrary: github.com/osohq/go-osoWhy: Uses the Polar language to define policies. Excellent for mixing ABAC ("User is in US region") with RBAC.4. Data Layer: ScyllaDB & RedisDatabase: ScyllaDBDriver: github.com/scylladb/scylla-go-driverWhy: This is a shard-aware driver. It knows exactly which CPU core on the database server holds the data, sending the request directly to that core (bypassing the coordinator node). This reduces latency significantly.Caching: RedisDriver: github.com/redis/go-redis/v9Usage: Cache compiled authorization decisions (e.g., "Is User X allowed to View Document Y?") for 30-60 seconds to avoid hitting the Policy Engine constantly.Matrix: How Requirements Map to LibrariesRequirementLibrary / Tool (Go)Implementation NoteFrameworkgithub.com/gofiber/fiber/v2Use the Prefork option for max throughput.SAMLgithub.com/crewjam/samlMiddleware that intercepts /saml/acs endpoints.OIDCgithub.com/coreos/go-oidcValidates JWTs from providers like Google/Auth0.RBAC / ABACgithub.com/casbin/casbinGood for simple role checks, but struggles with ReBAC.ReBACgithub.com/openfga/go-sdkChecks graph relationships (Zanzibar model).Databasegithub.com/scylladb/scylla-go-driverEnsure TokenAwareHostPolicy is enabled.