Practitionist / Practitionist/elluminar_web
Enterprise SSO: verify OIDC E2E against real IdP + SAML/SCIM decision records
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 0
- Avg merge
- 17h 2m
- Merged PRs (30d)
- 18
Description
Verified state: BetterAuth sso() plugin registered (auth/index.ts:173) w/ org provisioning + domainVerification; org owners register OIDC providers (org-sso.ts); admin trust flip at /admin/sso; sign-in surface exists. OIDC is genuinely implemented — but never tested end-to-end. SAML advertised in schema only. SCIM absent.
- E2E harness: test tenant + Okta dev account; register→verify→work-email sign-in→JIT membership→seat claim; Playwright spec (mocked OIDC); fix whatever breaks
- SAML decision record: recommend defer (OIDC covers Okta/AzureAD/Google Workspace); trigger conditions for a bridge later
- SCIM: design-only doc (/api/scim/v2 routes, org-scoped bearer tokens, Users↔Member mapping) — build only when >100-seat buyer requires it
- Admin queue polish at /admin/sso; issuer .well-known validation before provider save
- Regression: unverified providers can never authenticate
Spec: temp prompt library 07-enterprise-sso-scim.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with auth/index.ts:173, org-sso.ts, and the /admin/sso flow, then review the temp prompt library 07-enterprise-sso-scim. Add the Playwright E2E coverage for the listed OIDC tenant and membership flow, regression coverage for unverified providers, and the requested SAML/SCIM decision documentation. Done means the documented decisions and admin validation work are complete and the E2E tests pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- playwright, typescript
- Domain
- authentication, backend-api-design, testing
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100