fix(sso): link Entra sign-ins to existing accounts and enforce unique provider IDs - #6311

Merged

waleedlatif1 merged 24 commits into

stagingfrom

worktree-sso-domain-verify-audit

Aug 6, 2026

Commits on Aug 6, 2026

fix(sso): link Entra sign-ins to existing accounts and enforce unique provider IDs
waleedlatif1
committed
b6eb0c8
fix(sso): revoke domain trust when verification is removed mid-update
waleedlatif1
committed
e4b9fcc
fix(sso): make domain-trust grants atomic and propagate revocation
waleedlatif1
committed
a0bd392
fix(sso): report a refused domain-trust grant instead of returning success
waleedlatif1
committed
4dea2d4
feat(sso): let admins map IdP claims, and trim setup comments
waleedlatif1
committed
016dbba
feat(sso): expose the standard enterprise IdP options in the setup form
waleedlatif1
committed
1a0203e
fix(sso): withhold domain trust from personal providers on the hosted deployment
waleedlatif1
committed
ec38a1a
docs(sso): correct the personal-provider trust note after the hosted gating
waleedlatif1
committed
7c3aa3b
fix(sso): drop the inert SAML algorithm selects, make NameID format clearable
waleedlatif1
committed
15cc971
docs(sso): tighten the personal-provider note to the self-host path it describes
waleedlatif1
committed
715c6ec
fix(sso): forward an empty SAML NameID format so the provider default can be restored
waleedlatif1
committed
91332e2
fix(sso): revoke trust for providers whose domain is spelled with a wildcard
waleedlatif1
committed
33e2cee
fix(db): give the SSO index migration the concurrent-build convention it skipped
waleedlatif1
committed
afd7e27
fix(sso): give the Enter shortcut the same guard as the Add domain button
waleedlatif1
committed
db92d43
fix(sso): stop the provider ID being editable after it is saved
waleedlatif1
committed
833932a
fix(sso): stop persisting generated IdP metadata so SAML cert rotation works
waleedlatif1
committed
2318480
fix(sso): always write SAML IdP metadata so clearing it takes effect on update
waleedlatif1
committed
e9949e9
fix(sso): hold the domain proof under a row lock while granting trust
waleedlatif1
committed
c564441
refactor(sso): write the two merge-sensitive SAML fields the same way
waleedlatif1
committed
eedc242
fix(sso): report the row the trust grant actually matched
waleedlatif1
committed
ee5fd2d
fix(sso): restore provider domain trust when a domain is re-verified
waleedlatif1
committed
9fff2d3
fix(sso): correct the domain-removal warning now that it disables sign-in
waleedlatif1
committed
c6b9d66
chore(sso): trim verbose comments
waleedlatif1
committed
27ade42
fix(sso): revert a rejected SSO update instead of leaving it stored
waleedlatif1
committed
7b735e4

Navigation Menu

Uh oh!

fix(sso): link Entra sign-ins to existing accounts and enforce unique provider IDs - #6311

fix(sso): link Entra sign-ins to existing accounts and enforce unique provider IDs#6311
waleedlatif1 merged 24 commits into
stagingfrom
worktree-sso-domain-verify-audit

Commits on Aug 6, 2026

fix(sso): link Entra sign-ins to existing accounts and enforce unique provider IDs

fix(sso): revoke domain trust when verification is removed mid-update

fix(sso): make domain-trust grants atomic and propagate revocation

fix(sso): report a refused domain-trust grant instead of returning success

feat(sso): let admins map IdP claims, and trim setup comments

feat(sso): expose the standard enterprise IdP options in the setup form

fix(sso): withhold domain trust from personal providers on the hosted deployment

docs(sso): correct the personal-provider trust note after the hosted gating

fix(sso): drop the inert SAML algorithm selects, make NameID format clearable

docs(sso): tighten the personal-provider note to the self-host path it describes

fix(sso): forward an empty SAML NameID format so the provider default can be restored

fix(sso): revoke trust for providers whose domain is spelled with a wildcard

fix(db): give the SSO index migration the concurrent-build convention it skipped

fix(sso): give the Enter shortcut the same guard as the Add domain button

fix(sso): stop the provider ID being editable after it is saved

fix(sso): stop persisting generated IdP metadata so SAML cert rotation works

fix(sso): always write SAML IdP metadata so clearing it takes effect on update

fix(sso): hold the domain proof under a row lock while granting trust

refactor(sso): write the two merge-sensitive SAML fields the same way

fix(sso): report the row the trust grant actually matched

fix(sso): restore provider domain trust when a domain is re-verified

fix(sso): correct the domain-removal warning now that it disables sign-in

chore(sso): trim verbose comments

fix(sso): revert a rejected SSO update instead of leaving it stored