SSO (Single Sign-On) Support

[514sid]

Hi everyone,

We're in the process of implementing SSO (Single Sign-On) support and would love your input on the initial design. The goal is to streamline authentication for enterprise users while keeping the system flexible and manageable.

Proposed SSO Design

Here's what we have planned so far:

1. SSO-based Sign-up/Login

   • Users can sign up or log in using an SSO provider (via SAML or OIDC).

2. Account Linking

   • Users can link their SSO identity to an existing account.

3. Workspace SSO Enforcement

   • Workspaces can enable or disable SSO enforcement.
   • If SSO is required, only users authenticated via the configured SSO provider can access the workspace.

4. Auto-Join via SSO

   • If a user logs in via SSO and the provider matches a workspace’s configuration, the user is automatically added to that workspace.

5. One SSO Provider per Workspace

   • Each workspace can configure only one SSO provider.

6. Protocol Support

   • Both OIDC and SAML will be supported initially.

7. No Group Provisioning (for now)

   • Group or role provisioning (e.g., via SCIM) is not planned in the first version.
   • Permissions within a workspace will need to be managed manually (via the UI or API).

[dimitrow7]

@514sid It all sounds great, it's an important part of the system and it's very good that you've set it up for development right from the start. Here are a few additional questions that occur to me when creating an initial integration plan.

• Can your SAML/OIDC login flow require a specific attribute/claim (e.g., entitlement=service_pro) and deny access if it’s missing or doesn’t match?
• Will Auto-Join only work if a valid entitlement claim is present, not just based on provider or domain match?
• Does your SP-initiated SSO flow also validate this attribute, to prevent users from bypassing the purchase gate?
• Do you support RelayState (SAML) / state (OIDC) for deep-linking users to the correct workspace/page after login?
• What NameID format do you recommend (email/persistent), and do you support account linking based on email/subject?
• How long does an SSO session remain active, and will the entitlement attribute be revalidated on the next login so we can revoke access quickly if needed?