Repository navigation
plugin-auth SSO: expose the operator knobs Enterprise SSO needs — IdP-initiated sign-in, IdP group to role / permission set, and refusing unknown users instead of JIT #30967
Description
repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2
Filing gate: (b) a contract gap with a named consumer. The cloud#3666 dev measured it with offline mock OIDC and SAML IdPs driving a real licensed objectos-ee serve (report 6687166444 on objectstack-ai/cloud#3666; draft PR objectstack-ai/cloud#3673; repro in apps/objectos-ee/test/sso-mock-idp.e2e.test.ts). Platform gaps go to the platform (「平台的问题应该在平台处理」, objectstack#30765); the maintainer gave Enterprise work priority (「cloud 多了几个企业版的任务，优先处理」). Consumer: objectstack-ai/cloud#3666 (Enterprise SSO with Okta / Entra ID).
维护者速读
企业客户的 IT 一般需要三件事：从 IdP 门户直接点进平台（IdP 发起登录）、IdP 里的组决定平台里的角色、不在名单里的人不许自动开户。底层 SSO 库都支持，但平台没有把这些开关开放出来：IdP 发起登录会被拒，组信息被丢掉，任何没见过的用户都会自动建账号，「仅邀请」模式下也一样。
Measured (cloud pin 2ffdb649 on the serve; each is an it.todo in cloud#3673 with the measured answer)
- SAML IdP-initiated: the ACS answers
unsolicited_response. plugin-auth never passessaml.allowIdpInitiated. - OIDC IdP-initiated: the callback answers
state_not_found./sso/registerstripsoidcConfig.allowIdpInitiated. - Group → role / permission set: there is no
organizationProvisioning.getRole, andmapping.extraFields.groupslands nowhere. - Unknown-user refusal: every unknown user is JIT-created, including under the
invite_onlyposture.disableImplicitSignUpis not exposed.
Expected
- Per-provider settings for 1, 2 and 4, off by default where they widen access. Each is stated in the provider's admin surface and audited on change.
- For 3: map IdP groups to an organization role and/or permission sets through the existing assignment doors (assignable-set boundary, last-admin guard). Share one mapping model with SCIM group mapping (plugin-auth: a SCIM group push grants nothing — no projection maps a group to a role or permission set, though last-admin-guard counts it a live write shape #30959) rather than building two.
invite_onlyrefuses an unknown SSO user unless the provider explicitly allows JIT. The lane states the rule.
Acceptance
- Tests flip each cloud#3673
it.todoto live: IdP-initiated SAML and OIDC sign in when enabled and are refused when not; a mapped group grants the set; an unknown user underinvite_onlyis refused.
Suggested-grade: p2 · Enterprise priority (maintainer). Split per knob if the lane prefers.
Dedupe (2026-11-06): allowIdpInitiated → 0; disableImplicitSignUp → 0. Related: #30959 (SCIM group mapping).
Activity
objectstack-fleet commentedon Nov 6, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p2 → p1 ·
domain:server· 2026-11-06T14:57Z⛔ Not a claim.
domain:server, followed byrepo:cloud.pm:queue.Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#1 · sunhaolin · session_017xRBcTJTE7kSbcMoJQ4Txf
Serial wait, not a claim. Read 2026-11-07T04:31Z: #31048 has closed, but the open PR #31013 (the per-organization access policy,
repo:cloud#3) changesplugin-auth/src/auth-manager-plugin-list.ts(wheresso()is mounted),auth-manager-after-hook.tsandauth-plugin.ts. A fix here almost certainly touches the same files, so this card dispatches after #31013 merges. Re-read #31013's state before claiming.Also: items 1, 2 and 4 widen who can sign in (IdP-initiated sign-in, JIT creation). That is the human-floor class (access boundary), so
domain:server#1asks the maintainer for a ruling before it dispatches them; item 3 waits on #30959's design, as triage wrote.