Disabling "Require SSO" option is not honored, SSO is still (apparently) required
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 22h 21m
- Merged PRs (30d)
- 586
Description
### Environment
SaaS (https://sentry.io/)
### Steps to Reproduce
This is essentially a long-standing bug that had already been reported here in #4633, I don't think it should've been closed.
1. Enable SSO for an organization.
2. Uncheck "Require SSO" ('Require members use a valid linked SSO account to access this organization').
### Expected Result
Both options of using email/password and SSO should be allowed if the option is not checked.
We confirmed that via `https://sentry.io/auth/login` users are able to get in.
### Actual Result
Only SSO is provided, as if "Require SSO" was enabled. We want to be able to log via SSO for internal users, but also allow external parties to register via email. If they access the login page without using the SaaS subdomain it works, which makes the whole experience really odd (see last screenshot).
Configuration:
Result:
### Product Area
Sign In
### Link
_No response_
### DSN
_No response_
### Version
_No response_
Contributor guide
Research direction
Start by reproducing the Sign In flow with SSO enabled and “Require SSO” unchecked, comparing access through the SaaS subdomain and https://sentry.io/auth/login. Trace how the organization setting affects the available login methods; done means both email/password and SSO are offered when requiring SSO is disabled.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100