SSO — Okta & Azure AD (v8.0)

Steps

1. Navigate to /login
2. Observe available sign-in buttons

Verify (3 checks)

• Google, Okta, and Microsoft sign-in buttons visible (only if env vars are set)
• Domain hint text shows all configured allowed domains
• Buttons absent when env vars are not set (no startup error)

Steps

1. Click "Continue with Okta"
2. Complete Okta authentication with allowed domain email
3. Verify redirect to dashboard

Verify (6 checks)

• Redirected to Okta login page
• After auth, redirected back to dashboard
• User created/updated in database via provisionSSOUser()
• User auto-provisioned to configured workspace if OKTA_DEFAULT_WORKSPACE_ID set
• Non-allowed domain redirected to /login?error=sso_domain_blocked
• Splunk log shows SSO login event

Steps

1. Click "Continue with Microsoft"
2. Complete Microsoft authentication
3. Verify redirect to dashboard

Verify (5 checks)

• Redirected to Microsoft login page
• After auth, redirected back to dashboard
• User provisioned with same pattern as Okta
• Domain restriction enforced (AZURE_AD_ALLOWED_DOMAINS)
• Workspace auto-assignment works if AZURE_AD_DEFAULT_WORKSPACE_ID set

Steps

1. Navigate to /settings/sso
2. Review three provider cards

Verify (5 checks)

• Three provider cards: Google, Okta, Microsoft
• Each card shows enabled/disabled status
• Domain restriction and allowed domains shown per provider
• Auto-provisioning workspace shown per provider
• User statistics with per-provider breakdown and distribution bar

Steps

1. Navigate to /settings/sso

Verify (2 checks)

• Redirected to /settings/profile (not shown 403 or blank)
• No SSO configuration data exposed