gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-27 18:57:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sso): harden SSO with role sync, security fixes, design compliance, and test coverage (#564)

Browse Source 
Rate-limit OIDC callback route and clear state cookie on all paths.
Validate GitHub API responses and add server-side config validation.
Sync SSO user roles on every login respecting seat limits.
Add LDAP connection timeout, bind DN warning, and multiple entry logging.
Replace Select with Combobox and apply card design tokens in SSOSection.
Expose OIDC scopes field in settings UI.
Fix hardcoded colors to use design system tokens.
Add standard and diagnostic logging throughout SSO flow.
Add tests for role sync, seat limits, LDAP escaping, and config validation.
Remove unused login-form.tsx template.
Update docs and screenshots for SSO feature.
This commit is contained in:
Anso
2026-04-13 17:46:38 -04:00
committed by GitHub
parent d184b7134b
commit 1d89e8ce59
11 changed files with 308 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/getting-started/sso-quickstart.mdx
+5 -1
View File
@@ -113,7 +113,11 @@ By default, all SSO users are assigned the **Viewer** role. To grant Admin to sp
- SSO_OIDC_ADMIN_CLAIM_VALUE=sencho-admins
```
This tells Sencho to check the `groups` claim in the OIDC ID token. If it contains `sencho-admins`, the user gets Admin.
This tells Sencho to check the `groups` claim in the OIDC ID token. If it contains `sencho-admins`, the user gets Admin. Roles are synced on every login, so removing a user from the admin group will demote them on their next sign-in.
<Note>
Some providers (e.g., Azure AD, Okta) require custom scopes to include group claims in the ID token. You can configure additional scopes in the **Scopes** field in Settings > SSO, or via environment variable. The default is `openid email profile`.
</Note>
## Full docker-compose.yml example with SSO