mirror of
https://github.com/supabase/supabase.git
synced 2026-10-05 09:25:06 +03:00
a3e71ba888
Implements comprehensive IdP-initiated login flow support, enabling organizations to configure SSO without email domains and support multiple SAML apps under the same domain (e.g., Dev/Staging/Prod environments). - Add "Enable SP-initiated login" toggle to SSOConfig.tsx - IdP-initiated flow is now always available (default) - SP-initiated flow is opt-in with domain requirement - Clear in-UI documentation explaining both flows - Make domains optional (only required when SP-initiated enabled) - Add form validation: domains required only if SP-initiated is ON - Fix org-switching bug: form now resets when switching organizations - Add organization.slug to useEffect dependencies - Prevent stale SSO config data from previous org being displayed - **IdP-initiated flow**: Users start login from identity provider dashboard - No domain configuration required - Enables multiple SAML apps per domain - Recommended default for enterprises - **SP-initiated flow**: Users start login at supabase.com (opt-in) - Requires email domain configuration - Maintains backward compatibility - **Both flows**: Can be enabled simultaneously for flexible access - Organizations can now create separate SSO providers for Dev/Staging/Prod - Each environment = separate SAML app in IdP - All using same email domain (e.g., company.com) - Users access via different IdP app tiles - No domain conflicts or subdomain requirements - Add 4 pages to SSO sidebar menu in NavigationMenu.constants.ts: - Understanding Login Flows (existing, now visible) - Choosing a Login Flow (existing, now visible) - Multiple SSO Providers (NEW comprehensive guide) - Testing and Best Practices (existing, now visible) Create comprehensive guide covering: - Multi-environment patterns (Dev/Staging/Prod with same domain) - Team separation, migration, and acquisition scenarios - Step-by-step setup for domainless providers - User access management and IDP app assignment strategies - Configuration synchronization and best practices - Troubleshooting common multi-provider issues Major expansion of testing-best-practices.mdx: - Fix outdated assumptions (domains no longer always required) - Add comprehensive login flow testing section: - IdP-initiated testing (no domains) - SP-initiated testing (with domains) - Domainless provider testing (multi-environment pattern) - Enhance auto-join testing with 8 detailed test phases: - Idempotency testing (no duplicate memberships) - Domainless configuration testing - Re-enablement testing (works on every login) - Add SSO account restrictions testing section - Add safe provider deletion testing with 4 test scenarios - Reorganize final checklist into 6 categorized sections Update azure.mdx, gsuite.mdx, okta.mdx: - Remove all "(coming soon)" references - Add guidance recommending IdP-initiated for multi-environment setups - Clarify domains are optional for IdP-initiated flow - Link to new Multiple SSO Providers guide **Domain Handling:** - Domains now optional in SSO provider configuration - Backend: `z.array(...).optional().default([])` - UI: Domains only required when SP-initiated toggle is ON - Empty array sent to API when SP-initiated disabled **Login Flow Logic:** - IdP-initiated: Always available, uses SAML assertion directly - SP-initiated: Requires domain lookup, opt-in only - Both flows can coexist with same SSO provider **Multi-Provider Support:** - Each provider has unique ACS URL - No domain conflicts (IdP-initiated doesn't check domains) - Enables unlimited providers per email domain - **Simplifies SSO setup**: No domain configuration needed by default - **Enables multi-environment**: Dev/Staging/Prod under same domain - **Improves UX**: One-click login from IdP dashboard - **Maintains compatibility**: SP-initiated still available as opt-in - **Better documentation**: Comprehensive guides for all scenarios ## UI ### SSO Disabled <img width="742" height="329" alt="sso-disabled" src="https://github.com/user-attachments/assets/73387777-181c-4206-9798-36f0d0790e4e" /> ### SSO Enabled - IdP-inititated (DEFAULT) <img width="742" height="1059" alt="sso-enabled-idp" src="https://github.com/user-attachments/assets/c189e08f-7642-4183-8853-dd5150b8a191" /> ### SSO Enabled - SP-intitiated <img width="727" height="1366" alt="sso-enabled-sp" src="https://github.com/user-attachments/assets/be5ad6dc-4803-446b-ae02-9edcbb5f42cd" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added comprehensive guides for SSO login flow selection, testing best practices, and configuring multiple providers * Updated provider-specific setup documentation (Okta, Azure, Google Workspace) with refined workflows and testing recommendations * **New Features** * Enhanced SSO configuration interface with SP-initiated login toggle and improved email domain management for flexible authentication flows <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Chris Stockton <chris.stockton@supabase.io> Co-authored-by: Chris Chinchilla <chris.ward@supabase.io> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Reference Docs
Supabase Reference Docs
Maintainers
If you are a maintainer of any tools in the Supabase ecosystem, you can use this site to provide documentation for the tools & libraries that you maintain.
Versioning
All tools have versioned docs, which are kept in separate folders. For example, the CLI has the following folders and files:
cli: the "next" release.cli_spec: contains the DocSpec for the "next" release (see below).cli_versioned_docs: a version of the documentation for every release (including the most current version).cli_versioned_sidebars: a version of the sidebar for every release (including the most current version).
When you release a new version of a tool, you should also release a new version of the docs. You can do this via the command line. For example, if you just released the CLI version 1.0.1:
npm run cli:version 1.0.1
DocSpec
We use documentation specifications which can be used to generate human-readable docs.
- OpenAPI: for documenting API endpoints.
- SDKSpec (custom to Supabase): for SDKs and client libraries.
- ConfigSpec (custom to Supabase): for configuration options.
- CLISpec (custom to Supabase): for CLI commands and usage.
The benefit of using custom specifications is that we can generate many other types from a strict schema (eg, HTML and manpages). It also means that we can switch to any documentation system we want. On this site we use Next.js, but on Supabase's official website, we use a custom React site and expose only a subset of the available API for each tool.
Contributing
To contribute to docs, see the developers' guide and contributing guide.