Repository navigation
SSO-only deployments: trusted domains sign in without linking, password sign-in can be turned off - #1237
Open
gedaiu wants to merge 6 commits into
Open
SSO-only deployments: trusted domains sign in without linking, password sign-in can be turned off#1237gedaiu wants to merge 6 commits into
gedaiu wants to merge 6 commits into
Conversation
…ccount with no password
…DC_ALLOWED_DOMAINS)
gedaiu
added a commit
to re-cinq/lore
that referenced
this pull request
Oct 15, 2026
…#2764) Sets the two settings from deeplethe/utopia#1237 on our Utopia: - `UTOPIA_OIDC_ALLOWED_DOMAINS=re-cinq.com`: a re-cinq.com Google login with a verified email links the Utopia account that has that email, or opens one (default workspace, viewer). Nobody has to set a password and link Google by hand any more, and people without an account get one. - `UTOPIA_PASSWORD_LOGIN=false`: the login page shows only "Sign in with Google", and password sign-in and registration are refused. If Google ever breaks, setting this back to `"true"` brings the password form back. It needs the image built from dev + #1234 + #1237 (`ghcr.io/re-cinq/utopia:0.1.0-dev-sso`), pinned in `terraform.tfvars`. Until then, the image running now ignores both settings. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1236
Two opt-in settings for deployments where the identity provider already decides who may sign in. Neither changes anything for a deployment that doesn't set them.
UTOPIA_OIDC_ALLOWED_DOMAINS(comma-separated). When a login's subject isn't linked, and the ID token's email isemail_verifiedand in one of these domains, Utopia links the active account with that email (case-insensitive). If there is none, it opens one through the same path as registration: default workspace, viewer, or the bootstrap admin on an empty deployment. The new account's password hash is!, which never verifies. The subject is then linked, so later logins go by subject as before. The callback and/auth/oidc/exchangeshare this mapping (account_of), so the exchange behaves the same. An unverified email, another domain, or an empty list gives today'sunlinked.UTOPIA_PASSWORD_LOGIN=false./auth/loginand/auth/registeranswer 422password_login_disabled,/auth/oidc/statusreportspassword_login, and the login page shows only the SSO button. If SSO isn't configured, the page keeps the form (loginSections), so the setting can't lock everyone out. Setting it back to true is the way in if the provider is down.Both are documented in
.env.example.Tests:
provisioned_email(verified, domain, look-alike domain, empty list), store tests for finding by email and opening a viewer account without a usable password, the exchange test extended with link-by-email, open-then-link-by-subject and unverified-refused, a route test for the password switch, andloginSections.test.ts. The full core, store and server suites pass against Postgres, along with clippy-D warnings, the web build and vitest.🤖 Generated with Claude Code