getsentry / getsentry/sentry

Disabling "Require SSO" option is not honored, SSO is still (apparently) required

Open
#88,200 6 comments 0 reactions 0 assignees View on GitHub
Bug Product Area: Sign In Waiting for: Product Owner
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
22h 21m
Merged PRs (30d)
586

Description

### Environment

SaaS (https://sentry.io/)

### Steps to Reproduce

This is essentially a long-standing bug that had already been reported here in #4633, I don't think it should've been closed.

1. Enable SSO for an organization.
2. Uncheck "Require SSO" ('Require members use a valid linked SSO account to access this organization').

### Expected Result

Both options of using email/password and SSO should be allowed if the option is not checked.

We confirmed that via `https://sentry.io/auth/login` users are able to get in.
Image

### Actual Result

Only SSO is provided, as if "Require SSO" was enabled. We want to be able to log via SSO for internal users, but also allow external parties to register via email. If they access the login page without using the SaaS subdomain it works, which makes the whole experience really odd (see last screenshot).

Configuration:
Image

Result:
Image

### Product Area

Sign In

### Link

_No response_

### DSN

_No response_

### Version

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Sign In flow with SSO enabled and “Require SSO” unchecked, comparing access through the SaaS subdomain and https://sentry.io/auth/login. Trace how the organization setting affects the available login methods; done means both email/password and SSO are offered when requiring SSO is disabled.

Written by the indexing model from the issue text.

Assessment

Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.