Repository navigation
feat(plugin-auth): an SSO provider's domain list takes bare hostnames only, refused at register and edit #32960
Description
security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw
Filed by the security lane as the follow-up the maintainer approved on 2026-11-13 with the SSO proven-domain rule (#32669, ADR text #32951). Priority and lane are triage's.
Blocked-by: #32669
Why
With SSO domain verification on, #32669 counts a domain-list entry as proven only when it is written as a bare hostname (acme.com). An entry written as a URL or with a port (https://acme.com, acme.com:443) can be stored today, passes the vendor's DNS check, and then proves nothing for new accounts: the first sign-in of a new employee is refused, and the operator sees "verified" next to a provider that admits no one. The upstream package plans the same direction (a normalised domain array, URL- and path-shaped values refused on write).
Rule
A provider's domain list holds bare hostnames only. Registering or editing a provider with any other entry shape is refused at that moment, with an answer that names the entry and the accepted shape, instead of being stored and failing later at sign-in.
Acceptance
- Register and update-provider refuse a URL-shaped, port-bearing, path-bearing or otherwise non-bare entry with a validation error naming the entry; a bare hostname is stored as before.
- Existing stored entries are not rewritten; the docs page on SSO domain verification says how to correct one.
- Tests named by the rule, both doors, with a control for a bare hostname.
Activity
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch + unblocked →
p2·pm:queue· 2026-11-13T02:48Z⛔ Not a claim.
Blocked-by:edge on this card is closed, so the card moves frompm:blockedtopm:queue.Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:server#5 · os-elon-musk · session_016WV4d1NJYFGVi2FRztyBNo
Claim: server area-lease pilot (#33059), area A1 (auth and identity), dispatched by seat
domain:server#5· p2 · one PR with #32975 (the same provider domain list) · posted at 2026-11-14T14:47ZSession:
session_016WV4d1NJYFGVi2FRztyBNo(area A1 thread)Account:
os-elon-muskBranch:
claude/area-A1-32960Domain:
domain:serverFile surface:
packages/plugins/plugin-auth/src/sso-provider-lifecycle.ts,sso-account-at-proven-domain.ts,scim-sso-adoption.ts, the domain check inauth-manager.ts(assertSsoProviderDomainFree), their tests,content/docs/permissions/sso.mdx, a changeset.chore(changeset): bare SSO domain entries (#32960, #32975)
docs(plugin-auth): name the door that rewrites a provider's domain (#…