feat: add sso enforcement for invite signup #25808
Conversation
|
Size Change: 0 B Total Size: 1.15 MB ℹ️ View Unchanged
|
📸 UI snapshots have been updated10 snapshot changes in total. 0 added, 10 modified, 0 deleted:
Triggered by this commit. |
📸 UI snapshots have been updated2 snapshot changes in total. 0 added, 2 modified, 0 deleted:
Triggered by this commit. |
📸 UI snapshots have been updated2 snapshot changes in total. 0 added, 2 modified, 0 deleted:
Triggered by this commit. |
📸 UI snapshots have been updated2 snapshot changes in total. 0 added, 2 modified, 0 deleted:
Triggered by this commit. |
📸 UI snapshots have been updated2 snapshot changes in total. 0 added, 2 modified, 0 deleted:
Triggered by this commit. |
|
I haven't reviewed the code yet but saw there are no changes to the backend, there should prob be some validation there? |
What sorta validation would you expect? I haven't changed any forms so it's using all of the same logic. The only thing is pushing to SSO if it's enforced. |
|
@zlwaterfield You shouldn't be able to use the API to sign up with username/password when SSO is enforced. |
Ah yes, I can add that in. |
|
@raquelmsmith added with tests. |
|
Looking into why snapshots changed because they shouldn't have. |
📸 UI snapshots have been updated4 snapshot changes in total. 0 added, 4 modified, 0 deleted:
Triggered by this commit. |
📸 UI snapshots have been updated6 snapshot changes in total. 0 added, 6 modified, 0 deleted:
Triggered by this commit. |
📸 UI snapshots have been updated2 snapshot changes in total. 0 added, 2 modified, 0 deleted:
Triggered by this commit. |
📸 UI snapshots have been updated2 snapshot changes in total. 0 added, 2 modified, 0 deleted:
Triggered by this commit. |
| > | ||
| Continue | ||
| </LemonButton> | ||
| {precheckResponse.status === 'pending' || !precheckResponse.sso_enforcement ? ( |
There was a problem hiding this comment.
Are these conditionals correct? If the response status is pending do we want to show the "continue" button?
There was a problem hiding this comment.
Will test a few things and confirm / improve.
📸 UI snapshots have been updated2 snapshot changes in total. 0 added, 2 modified, 0 deleted:
Triggered by this commit. |
Problem
Right now, SSO enforcement is not upheld on the invite signup page. An invited user can login with password or one of our social SSO options (Google, Github, Gitlab) and there is no SAML option.
Here is what it looks like:
If the domain of the invite has SSO enforcement on then we want to show the correct button (SAML, Google, etc.) like we do on the login page. And we need to make sure we pass the invite ID through so it can accept the invite as well.
Changes
This PR adds the precheck call to check on the invite signup page using the domain of the email being invited. If it's turned on it then will hide all other fields (password, name, etc.) as well as the social SSO buttons along the bottom and show the SSO login button instead.
It also adds an
actionTextto the SSO login button props so we can show "Continue with.." instead of "Login with".Note: with this change we will no login take in the
Rolefield. We could look into adding it into the support fields for the SSO extra fields so it's processed on the SSO callback.Here is what is would look like:
👉 Stay up-to-date with PostHog coding conventions for a smoother review.
Does this work well for both Cloud and self-hosted?
Yes
How did you test this code?
Need to do some more manual testing on this to confirm the invite gets accepted correctly. Here is where it happens: https://github.com/PostHog/posthog/blob/master/posthog/api/signup.py#L517-L519