Enterprise identity (SSO)

The screen configures one connection to a corporate identity provider. Ordinary username-and-password sign-in stays live beside it — enterprise identity is added to it, not substituted for it.

The two protocols

OIDC is the sign-in flow implemented today, and against a compatible provider it works end to end. SAML appears on the screen as configuration only at this stage: the details can be saved, there is no automatic connection test for it, and the screen says so rather than looking as though a live flow is waiting behind it.

The order to configure in

1. Copy the return address

   The screen shows a read-only box with the callback address and a copy button beside it. It is an address of ours, not a field to fill in.

2. Register it at the identity provider

   That address has to be registered as the application's authorized return address. The provider compares it character for character.

3. Fill in the provider details and save

   The test runs against the saved configuration, so save before testing.

4. Test

   "Test" contacts the provider at the address you saved and reports whether it answered as expected.

5. Turn on the button

   "Shown on the login screen" is a separate switch. Until it is on — and saved — there is no enterprise sign-in button on the login screen.

Role mapping

The mapping table translates a value from the provider's role claim into a role in the system. The picker offers the existing roles, and there is a raw JSON editing mode for anyone who prefers it.

With no mapping, everyone signing in through the provider gets the default role. That is a valid state to start from, but not one to stay in: it draws no line between someone who should view and someone who should manage.

One connection per protocol

If several connections of one kind exist — after configuration through the API, for instance — the most recently edited one is the one the system actually reads, and it is the one the screen edits. The rest are listed in an amber note with a delete affordance, because a shadowed connection nobody can see is the likeliest explanation for "I changed it and nothing happened".