gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-10 18:56:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): honor SSO-only CLI recovery without restart (#1810)

Browse Source
This commit is contained in:
Anso
2026-08-09 23:48:44 -04:00
committed by GitHub
parent 55ca82abb2
commit 27fe0ae837
9 changed files with 86 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/sso.mdx
+3 -5
View File
@@ -97,10 +97,9 @@ If the identity provider is unavailable after SSO only is enabled, restore local
```bash
docker compose exec sencho node dist/cli/enableLocalLogin.js
docker compose restart sencho
```
Restart is required so the running process reloads the setting. The same command is listed under **Settings → Operations → Recovery**.
No restart is required; the next login attempt honors the restored mode. The same command is listed under **Settings → Operations → Recovery** and in [Emergency command-line recovery](/operations/emergency-cli).
<Frame>
<img src="/images/sso/sso-settings.png" alt="SSO settings panel listing the five identity providers as collapsible cards with enable / disable toggles" />
@@ -335,14 +334,13 @@ If not set, Sencho auto-detects the URL from the request's `Host` header and pro
Confirm the provider is enabled (toggle on, showing the Active badge) under **Settings → Access → SSO** and that the configuration saved successfully. The login page fetches the list of enabled providers when it loads; hard-refresh the tab if changes were just made.
</Accordion>
<Accordion title="Locked out after enabling SSO only">
From the host that runs Sencho, re-enable local password login and restart so the setting takes effect:
From the host that runs Sencho, re-enable local password login:
```bash
docker compose exec sencho node dist/cli/enableLocalLogin.js
docker compose restart sencho
```
Then sign in with a local administrator account and repair the identity provider configuration before enabling SSO only again.
Then sign in with a local administrator account and repair the identity provider configuration before enabling SSO only again. No restart is required.
</Accordion>
<Accordion title="'Cannot disable/delete the last SSO provider while SSO-only mode is active'">
docs/operations/emergency-cli.mdx
+11 -1
View File
@@ -80,7 +80,17 @@ docker compose exec sencho node dist/cli/disableSso.js [provider]
docker compose exec sencho node dist/cli/disableSso.js oidc_google
```
With no argument it disables every enabled provider. The stored configuration is preserved (only the enabled flag is cleared), so you can correct it and turn it back on from **Settings · SSO**.
With no argument it disables every enabled provider and, if **SSO only** mode is active, restores **Local and SSO** so password login works again. The stored configuration is preserved (only the enabled flag is cleared), so you can correct it and turn it back on from **Settings · SSO**. No Sencho restart is required.
### Re-enable local password login (SSO only)
When authentication mode is **SSO only** and the identity provider is unavailable, restore local password login without disabling providers:
```bash
docker compose exec sencho node dist/cli/enableLocalLogin.js
```
Takes effect on the next login attempt; no restart is required. See [SSO & LDAP Authentication](/features/sso#troubleshooting) for the full SSO-only recovery path.
## Inspecting and protecting your data