- Shipped
- November 15, 2026 at 7:56 AM UTC
- Author
- Kamo
- Commit
- 2d1d54d
/auth/sso/<connectionId> (federation/start with connectionId; hops to the callback origin once; SAML start writes the binding + context cookies path / SameSite=None so they ride the provider's cross-site POST), /auth/callback/sso/<id> (OIDC, GET) and POST /saml/<id>/acs (SAML) relay to securityservice and route the outcome like a social sign-in (session planted, MFA, picker, link page with the connection's name, plain card) plus TEST_COMPLETE -> /auth/sso/test-done (an administrator's test; nobody signed in). GET /saml/<id>/metadata relays the SP metadata. signin/identify answering SSO shows 'Your Organization Uses <name>' with Continue With <name> above the password form (owners and break-glass members keep their password; securityservice refuses anyone else's with SSO_REQUIRED, now a refusal card carrying the same button). signin/methods sso buttons on the organization's own sign-in page. Dictionary 93db29960 first. Verified: npm test 103/103, check-i18n-keys, tsc clean, harness screenshots (method step, required, identify buttons, refusal; desktop light/dark + phone).