# SSO

On Business and Enterprise, members can sign in through your company's identity provider. It's OpenID Connect only, with the authorization code flow, PKCE and a nonce. There's no SAML.

Tested end to end with Okta.

### 1. Register an app with your provider

Create an OpenID Connect web app with this callback URL:

```
https://latitude10.tech/api/workspace/auth/sso/callback
```

The callback's path is `/api/workspace/auth/sso/callback`.

### 2. Connect it

Owners do this on the workspace's SSO settings page: enter the provider's issuer URL, the app's client id and its secret. The provider's endpoints are found from the issuer by discovery. The secret is sealed and never shown again.

### 3. Prove your email domains

Your provider is trusted only for addresses on domains the workspace has proved: see [Email domains](domains).

### 4. Test it

**Run a test sign-in** goes through the provider once and shows the claims it sent. It passes when your email is on a proved domain, and your session doesn't change. A passing test is recorded on the connection.

### 5. Require it, if you want

With **Require SSO** on, members get into the workspace only with a session made through this connection in the last 12 hours. Owners keep a logged way in if the provider breaks: see [Break-glass](break-glass).

## What we ask for and use

- The scopes `openid email profile`.
- `sub`, which ties the provider's user to one account here.
- `email`, which must be on a proved domain, and isn't accepted when `email_verified` is false.
- `name`, for display.

An account is tied to the provider's `sub`. If a provider's user signs in with an address that another account here already has, the sign-in is refused, so an account can't be taken over by changing the provider's records.

## New people

Optionally, people with an address on a proved domain who aren't members yet can join on their first SSO sign-in, as viewers or editors, while a seat is free. Without it, they need an invitation.

## Where this comes from

- `app/enterprise/_lib/sso.ts`
- `app/enterprise/_lib/gate.ts`
- `app/enterprise/_lib/domains.ts`
- `app/hosted-mcp/_lib/idp.ts`
- `app/api/workspace/auth/sso/callback/route.ts`
- `app/workspace/enterprise-actions.ts`
- `docs/runbooks/enterprise.md`