Repository navigation
docs(sso): the SSO page does not describe mapping an identity provider's groups to permission sets #31658
Description
domain:server#2 · os-steve · session_01ADHkmQKZzp4DLtqiCkZZRM
Filing gate: ② a follow-up the seat's ACCEPT of PR #31657 (#30967 item 3) names, from the dev's open question 4. ⛔ Not a claim.
Reader: domain:server (the plugin-auth SSO surface). File: content/docs/permissions/sso.mdx.
Dedupe (open AND closed): sso.mdx group mapping → #30967 only.
reach: every operator configuring SSO who wants IdP groups to grant permission sets.
class: b · type: Documentation
Grade: left to triage (seat suggests p3).
维护者速读
#30967 第 3 项（PR #31657）之后，SSO 登录会按身份提供方的组，授予 sys_idp_group_mapping 映射到的普通权限集。SSO 文档页还没写这件事：怎样在提供方的 mapping.extraFields.groups 里配置组声明，怎样用 providerId 保存映射，以及组声明缺失时会撤回该提供方先前授予的权限集。
What is missing (read in the tree at the seat's ACCEPT)
content/docs/permissions/sso.mdxnames no group mapping.- The behaviour an operator needs, as PR feat(plugin-auth): an SSO sign-in grants the permission set its IdP group is mapped to #31657's changeset states it: the groups claim is configured in the provider's own
mapping.extraFields.groups; a mapping is saved throughPOST /admin/scim/set-group-mappingwithproviderId(exactly one ofconnectionId/providerId); only ordinary permission sets inside the provider's organization are granted; grants follow the IdP at every sign-in, and an absent claim removes that provider's own earlier grants; a failure is logged and never fails the sign-in.
Expected
- A short section on the SSO page with the above, linking the SCIM page's group-mapping section (one model, two sources).
Activity
objectstack-fleet commentedon Nov 8, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage:
domain:server· p3 ·pm:queue· 2026-11-08T19:54Z⛔ Not a claim.
domain:server. Under [Decision] Keepdomain:devxanddomain:serveras separate lanes, or merge them? Measured load and boundary friction, 2026-11-08 #31424 rule 1 a docs page rides the package it documents;content/docs/permissions/sso.mdxdocuments plugin-auth SSO.finding→ graded.Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
domain:server#2 · os-steve · session_01ADHkmQKZzp4DLtqiCkZZRM
Claim: PM loop round 4 · 2026-11-08T20:03Z
Session:
session_01ADHkmSWdZY3vu8awytLsrR(card thread, dev) · seatsession_01ADHkmQKZzp4DLtqiCkZZRMAccount:
os-steveBranch:
claude/project-thread-h5ftloWorktree:
objectstack-issue-31658Domain:
domain:serverSeat:
domain:server#2File surface:
content/docs/permissions/sso.mdx(and one back-link line on the SCIM page). ⛔ Nothing elseContainer & model: S (docs),
mode:thread,model: default tier,effort: lowClause-②: no
Metadata-protocol: none
Responsibility: #30967 item 3 (PR #31657) adds the behaviour; its docs were left to this card (seat ACCEPT of #31657)
Thread-read: 6726322361
Premise: holds as filed, read at claim on
origin/main532230f3:sso.mdxnames no group mappingSerial constraints cleared: PR #31657 must merge before this PR opens (the page documents merged behaviour); the dev merges main first. No open PR touches
sso.mdxScope: Fixes #31658. The section states rules only, from the merged code and #31657's changeset: the claim in
mapping.extraFields.groups; the save and delete doors withproviderId; ordinary sets inside the provider's organization only; grants follow the IdP at each sign-in and an absent claim removes that provider's own grants; a failure never fails the sign-in. Order:/mnt/project-files/server-seat2/standard-order.md+/mnt/project-files/server-seat2/31658-delta.md. Summons: the maintainer's 「并发都是5」 (project chat, 2026-11-08T16:13Z).objectstack-fleet commentedon Nov 8, 2026
domain:server#2 · os-steve · session_01ADHkmSWdZY3vu8awytLsrR
os-dev-report
{ "issue": 31658, "status": "done", "branch": "claude/project-thread-h5ftlo", "pr": "https://github.com/objectstack-ai/objectstack/pull/31664", "session": "session_01ADHkmSWdZY3vu8awytLsrR", "premise_still_valid": true, "summary": "content/docs/permissions/sso.mdx gains the section 'Grant permission sets from IdP groups' (the SSO half of IdP group mapping from PR #31657): the groups claim in the provider's own mapping.extraFields.groups, the set/delete-group-mapping door with providerId, ordinary sets inside the provider organization only, grants following the IdP at every sign-in (an absent claim removes only that provider's own grants), and a failure that never fails the sign-in. The SCIM Connection Credentials section of authentication.mdx gains one back-link line. Read from the merged code and #31657's changeset (byte-identical between #31657's last head 70db6d06 and origin/main 8c9260f7). Two delta premises did not hold and the seat accepted both readings: no SCIM group-mapping docs section exists, so the links use SCIM Connection Credentials; ADR-0152 is not on main, so it is not linked.", "tests": "Docs only: no test and no ablation (os-dev: docs are not ablated). Verification is the derived doc gate family on head a7bcac5c, see gates.", "gates": "Head a7bcac5c (origin/main 8c9260f7 merged in). dispatch-gates --commands --repo objectstack-ai/objectstack derived 45; all 45 run, each exit 0 (captured before any pipe, per-command log), after rebuilding spec, lint and the client-react closure for the merged tree under os-verify-lock (VERDICT command-exit 0). --ran: 45 derived, 45 run, 0 NOT-MEASURED, 0 UNRUN. check:doc-anchors: 956 fragment links resolve. Pre-merge head af648c0e: same 45, check:skill-examples first exit 3 (PREREQUISITE NOT MET, client-react had no .d.ts), green after building it. pnpm lint: no package touched, n/a. CI check-runs: in_progress at report time.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm", "mcp_calls": "5 — all reads: issue_read get_comments x2, pull_request_read get x2, pull_request_read get_files x1; no write tool", "api_writes": "2 — relay pr_create (PR #31664, labels skip-changeset, read-back 5319 bytes sent = stored), this os-dev-report comment via post-stamped.mjs", "files_changed": [ "content/docs/permissions/sso.mdx (+58)", "content/docs/permissions/authentication.mdx (+4)" ], "line_budget": "62 changed lines (+62 / -0), under the 3000 human-merge threshold", "deviations": [ "The delta's 'SCIM page's group-mapping section' does not exist on main; linked the SCIM Connection Credentials section instead (seat accepted).", "ADR-0152 not linked: not on origin/main (seat accepted)." ], "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "class: none (docs gap, not a defect class) · no page under content/docs describes the SCIM half of IdP group mapping (PR #31443): zero hits for set-group-mapping / sys_idp_group_mapping outside this diff · carrier: none · noted, not filed", "class: none (feature gap) · the Setup → SSO Providers bridge (register-sso-provider.ts) writes oidcConfig.mapping as { email, name } only and no SAML mapping, so the groups claim can only be configured through the vendor's /sso/register · carrier: none · noted, not filed" ] }Stamped 2026-11-08T21:01Z.
Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
domain:server#2 · os-steve · session_01ADHkmQKZzp4DLtqiCkZZRM
ACCEPT → PR #31664 comment 6727279937 · head
a7bcac5c· 2026-11-08T21:21Z · landing: pr_ready + automerge_enable · follow-up filed: #31666objectstack-fleet commentedon Nov 8, 2026
domain:server#2 · os-steve · session_01ADHkmQKZzp4DLtqiCkZZRM
落地 · 2026-11-08T21:46Z
cd43416f(ACCEPT 6727279937; docs only, no contract review face)Fixes #31658)Landed:
content/docs/permissions/sso.mdxgains "Grant permission sets from IdP groups": the claim inmapping.extraFields.groups, the save and delete doors withproviderId, ordinary sets inside the provider's organization only, grants following the IdP at each sign-in, an absent claim removing the provider's own grants, a failure never failing the sign-in.