- Shipped
- November 15, 2026 at 9:56 AM UTC
- Author
- Kamo
- Commit
- 5512e45
Settings › Security › Identity & Sign-In now has three sections on ?section= — Sign-In Methods (717), Identity Providers and Provisioning (MANAGE_IDENTITY_PROVIDERS 718; SecurityService's IDP_CONNECTION_HEALTH notice links section=providers). The tab, menu entry, landing card and settings registry open on either right. - Identity Providers: a card per connection (provider mark, Being Set Up / Ready To Turn On / On / Off, health chip that pulses when it needs attention, Optional / Required badge, countdown rings for the signing certificate and the client secret, last sign-in, last test, verified domains, recent problems in words, CornerRibbon in the health colour) with one split button (Continue Setup / Edit, Run A Test Sign-In, Check It Now, Connection Details drawer, Turn On / Turn Off with confirmation, Remove — refused while on). First-timer card with the provider logos. Emergency Access card: owners + chosen people as MemberChips with Two-Step / Passkey / No Second Step Yet, MemberPickerDialog to add. - Six-step wizard (the IoT link wizard's flow, full width): 1 logo grid from the server's templates (Another Kamo Organization stays hidden — SecurityService omits KAMO_ORG until Phase 5), OpenID Connect or SAML where both are spoken, name; saved as a DRAFT so 2 shows the server's redirect / ACS / entity id / SP metadata addresses with copy buttons beside provider-specific where-to-paste steps; 3 discovery address + client id/secret/secret expiry, or SAML metadata address / metadata file upload / by hand, Read Settings → found cards (issuer, sign-in host, keys or certificates with expiry), never XML; 4 drag (or tap) claims onto fields with sample values from a test sign-in, group rules → role / department / job title / teams, match-by-name and official-title switches; 5 Test Sign-In popup on the org's own login host, polled to a plain-language result card ("Maria Lopez would sign in as Loan Officer in Sales, on 2 teams") with every check and failure codes in everyday words; 6 only ownership-verified domains, Optional / Required For These Domains / Required For Everyone (locked with the reasons until a test passed, someone on the emergency list has MFA or a passkey, and a verified domain is chosen), trust provider MFA, new people Active / Waiting For Approval with a default role, keep details up to date, emergency access; Save And Finish Later / Save And Turn On. - Provisioning: per connection, SCIM on/off (on = a working token; off revokes every token), provisioning address, make a token (shown once with copy), revoke, last used, where-to-paste steps per provider, what a removal does (always Terminate, never delete), what provisioning changes, recent removals from the access log (MemberChipById; a role without VIEW_ACCESS_LOGS is told why the list is hidden). - Relay **************** app/lib/identity/idp.ts (parsing + pure rules, 15 tests), idpApi.ts, idpHelp.ts; help mark on every control; help center articles identity-providers, set-up-single-sign-on, automatic-provisioning (published) + security index; MotionConfig reducedMotion="user"; org brand colours only.