- Shipped
- November 15, 2026 at 7:37 AM UTC
- Author
- Kamo
- Commit
- 7a63fd0
idp/: **************** CRUD + refresh + test/start|result + activate|disable + break-glass (MANAGE_IDENTITY_PROVIDERS 718, IDP_CONNECTION_CHANGED on every write). OIDC discovery (issuer checked, https only, SSRF-guarded: every admin-typed / document-named URL must resolve to public addresses), JWKS + x5c expiry. federation/start|callback with connectionId -> IdpSignInService: PKCE+nonce+state, id_token proven by the existing IdTokenValidator (asymmetric only, iss/aud/azp/exp/nonce), client_secret_basic default; identity (iss, sub, connection id) ORG_IDP; auto-link + JIT only over the connection's ownership-verified domains (else the link-page proof); JIT through **************** (TEAM_MEMBER ACTIVE|PROSPECT, email verified, no verification letter); mapping claims/groups -> department, job title, official title, role, teams (TeamWriter seam + org graph + MemberRightsAppliedService => rights push live), sync_on_signin; trusted IdP MFA via amr/acr; completeOrgIdp (that org only; never on another tenant's domain). TEST runs the whole validation and stores the result card (who, which account action, role/department/title/teams, MFA) - writes nothing. signin/identify routes by host + domain over ACTIVE connections and ownership_verified rows only; signin/methods lists sso buttons. SsoEnforcement: REQUIRED_DOMAINS / REQUIRED_ALL refuse a covered member's password for THAT org (403 SSO_REQUIRED + sso button data; picker drops the org and scopes the select token) and refuse a reset only when the password works nowhere; owners + org_break_glass_members always exempt; fails open; inert until an admin activates a required connection. Activation needs a passing test; REQUIRED needs >= 1 break-glass member with MFA or a passkey. IdpHealthJob (6h, singleton): metadata/keys refresh, cert/secret expiry + unreadable metadata -> one IDP_CONNECTION_HEALTH notification per event. SAML seams (SamlServiceProvider, ****************