feat(sso): let organizations require single sign-on

Adds an organization setting that refuses password and email-code sign-in
for members, enforced when a session is created so enabling it signs
nobody out. Owners keep every sign-in method as a break-glass path, and
the requirement stops enforcing if no identity provider on a verified
domain is left to satisfy it.

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/sso.mdx

@@ -319,8 +319,18 @@ With **Automatic** provisioning, no invitation is required for organization memb
 
 SSO provisioning creates internal organization members but does not grant workspace access. To grant workspace access from your identity provider, use [directory provisioning](/platform/enterprise/scim) and map a pushed group to a workspace. External workspace members are different: they are invited to a specific workspace without joining your organization or consuming one of your seats. Existing invitations and external access take precedence over automatic provisioning so their intended role and workspace grants are preserved.
 
+## Require single sign-on
+
+By default members can sign in with a password, an email code, or your identity provider. To make single sign-on the only way in, open **Settings → Organization → Single sign-on → Sign-in** and set **Allowed sign-in methods** to **Single sign-on**. It becomes available once the organization has an identity provider on a verified domain.
+
+- The requirement is checked when a session is created, so turning it on signs nobody out. Members keep working and meet the requirement at their next sign-in. To end current sessions too, use **Sign out all members** under **Settings → Organization → Security**.
+- Organization owners keep every sign-in method. If the identity provider breaks, an owner can still sign in with a password and turn the requirement back off.
+- If the last identity provider is deleted or its domain verification lapses, the requirement stops being enforced instead of locking the organization out, and you can switch back to any method at any time.
+- Desktop app handoff from an already signed-in browser keeps working, because that session derives from one the requirement already admitted.
+- A member who tries a password or email code sees a message telling them to sign in through their identity provider.
+
 <Callout type="info">
-  Password-based login remains available. Forcing all organization members to use SSO exclusively is not yet supported.
+  Turning the requirement off restores password and email sign-in immediately for everyone.
 </Callout>
 
 ---
@@ -352,7 +362,7 @@ SSO provisioning creates internal organization members but does not grant worksp
   },
   {
     question: "Can I still use email/password login after enabling SSO?",
-    answer: "Yes. Enabling SSO does not disable password-based login. Users can still sign in with their email and password if they have one. Forced SSO (requiring all users on the domain to use SSO) is not yet supported."
+    answer: "Yes, unless you require single sign-on. Enabling SSO does not disable password login on its own; set Allowed sign-in methods to Single sign-on to refuse password and email-code sign-in for members. Organization owners keep password sign-in as a way back in if the identity provider breaks."
   },
   {
     question: "A user already has an account with the same email — what happens when they sign in with SSO?",

apps/sim/app/(auth)/login/login-form.tsx

@@ -202,6 +202,19 @@ export default function LoginPage({
               return
             }
 
+            /**
+             * A policy refusal explains itself — an organization requiring single sign-on, or a
+             * suspended account. Leading with "Invalid email or password" would send the person
+             * to reset a password that is fine.
+             */
+            if (ctx.error.status === 403 && ctx.error.message) {
+              errorHandled = true
+              setResetSuccessMessage(null)
+              setPasswordErrors([ctx.error.message])
+              setShowValidationError(true)
+              return
+            }
+
             errorHandled = true
             const errorMessage: string[] = ['Invalid email or password']
 

apps/sim/app/api/organizations/[id]/sso-policy/route.test.ts

@@ -0,0 +1,142 @@
+/**
+ * @vitest-environment node
+ */
+import { member, organization, ssoProvider } from '@sim/db/schema'
+import {
+  authMockFns,
+  createMockRequest,
+  dbChainMockFns,
+  queueTableRows,
+  resetDbChainMock,
+  resetEnvFlagsMock,
+  setEnvFlags,
+} from '@sim/testing'
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockIsEnterprise, mockRecordAudit, mockInvalidate } = vi.hoisted(() => ({
+  mockIsEnterprise: vi.fn(),
+  mockRecordAudit: vi.fn(),
+  mockInvalidate: vi.fn(),
+}))
+
+vi.mock('@/lib/auth/sso-policy', () => ({
+  invalidateSsoPolicyCache: mockInvalidate,
+}))
+
+/**
+ * These tests run with billing enabled, where `isOrganizationFeatureEntitled`
+ * delegates straight to the plan check.
+ */
+vi.mock('@/lib/billing/core/subscription', () => ({
+  isOrganizationOnEnterprisePlan: mockIsEnterprise,
+  isOrganizationFeatureEntitled: mockIsEnterprise,
+}))
+
+vi.mock('@sim/audit', () => ({
+  recordAudit: mockRecordAudit,
+  AuditAction: { ORGANIZATION_SSO_POLICY_UPDATED: 'organization.sso_policy.updated' },
+  AuditResourceType: { ORGANIZATION: 'organization' },
+}))
+
+import { GET, PUT } from '@/app/api/organizations/[id]/sso-policy/route'
+
+const mockGetSession = authMockFns.mockGetSession
+
+const ORG_ID = 'org-1'
+const routeContext = { params: Promise.resolve({ id: ORG_ID }) }
+
+beforeAll(() => {
+  setEnvFlags({ isBillingEnabled: true })
+})
+
+afterAll(resetEnvFlagsMock)
+
+describe('sso policy route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    mockGetSession.mockResolvedValue({
+      user: { id: 'user-1', name: 'Admin', email: 'admin@acme.dev' },
+      session: { token: 'tok-1' },
+    })
+    mockIsEnterprise.mockResolvedValue(true)
+  })
+
+  describe('GET', () => {
+    it('returns 401 when unauthenticated', async () => {
+      mockGetSession.mockResolvedValue(null)
+      const response = await GET(createMockRequest('GET'), routeContext)
+      expect(response.status).toBe(401)
+    })
+
+    it('returns 403 for non-members', async () => {
+      queueTableRows(member, [])
+      const response = await GET(createMockRequest('GET'), routeContext)
+      expect(response.status).toBe(403)
+    })
+
+    it('reports the requirement and whether a provider can satisfy it', async () => {
+      queueTableRows(member, [{ id: 'member-1' }])
+      queueTableRows(organization, [{ requireSso: true }])
+      queueTableRows(ssoProvider, [{ id: 'provider-1' }])
+
+      const response = await GET(createMockRequest('GET'), routeContext)
+      expect(response.status).toBe(200)
+      await expect(response.json()).resolves.toMatchObject({
+        data: { requireSso: true, hasVerifiedProvider: true },
+      })
+    })
+  })
+
+  describe('PUT', () => {
+    it('rejects non-admin members', async () => {
+      queueTableRows(member, [{ role: 'member' }])
+      const response = await PUT(createMockRequest('PUT', { requireSso: true }), routeContext)
+      expect(response.status).toBe(403)
+    })
+
+    it('rejects organizations without the entitlement', async () => {
+      queueTableRows(member, [{ role: 'owner' }])
+      mockIsEnterprise.mockResolvedValue(false)
+      const response = await PUT(createMockRequest('PUT', { requireSso: true }), routeContext)
+      expect(response.status).toBe(403)
+    })
+
+    it('refuses to require SSO with no verified provider', async () => {
+      queueTableRows(member, [{ role: 'owner' }])
+      queueTableRows(organization, [{ name: 'Acme' }])
+      queueTableRows(ssoProvider, [])
+
+      const response = await PUT(createMockRequest('PUT', { requireSso: true }), routeContext)
+      expect(response.status).toBe(400)
+      expect(dbChainMockFns.update).not.toHaveBeenCalled()
+    })
+
+    it('turns the requirement on, invalidates the cache, and records audit', async () => {
+      queueTableRows(member, [{ role: 'admin' }])
+      queueTableRows(organization, [{ name: 'Acme' }])
+      queueTableRows(ssoProvider, [{ id: 'provider-1' }])
+      dbChainMockFns.returning.mockResolvedValueOnce([{ id: ORG_ID }])
+
+      const response = await PUT(createMockRequest('PUT', { requireSso: true }), routeContext)
+      expect(response.status).toBe(200)
+      await expect(response.json()).resolves.toMatchObject({ data: { requireSso: true } })
+      expect(dbChainMockFns.set).toHaveBeenCalledWith(expect.objectContaining({ requireSso: true }))
+      expect(mockInvalidate).toHaveBeenCalledWith(ORG_ID)
+      expect(mockRecordAudit).toHaveBeenCalledWith(
+        expect.objectContaining({ action: 'organization.sso_policy.updated' })
+      )
+    })
+
+    it('turning the requirement off needs no provider', async () => {
+      queueTableRows(member, [{ role: 'owner' }])
+      queueTableRows(organization, [{ name: 'Acme' }])
+      queueTableRows(ssoProvider, [])
+      dbChainMockFns.returning.mockResolvedValueOnce([{ id: ORG_ID }])
+
+      const response = await PUT(createMockRequest('PUT', { requireSso: false }), routeContext)
+      expect(response.status).toBe(200)
+      await expect(response.json()).resolves.toMatchObject({ data: { requireSso: false } })
+    })
+  })
+})

apps/sim/app/api/organizations/[id]/sso-policy/route.ts

@@ -0,0 +1,176 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import { member, organization } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
+import { and, eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { updateOrganizationSsoPolicyContract } from '@/lib/api/contracts/organization'
+import { parseRequest, validationErrorResponse } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { hasSignInCapableSsoProvider } from '@/lib/auth/sso/verified-provider'
+import { invalidateSsoPolicyCache } from '@/lib/auth/sso-policy'
+import { isOrganizationFeatureEntitled } from '@/lib/billing/core/subscription'
+import { isBillingEnabled, isSsoEnabled } from '@/lib/core/config/env-flags'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('SsoPolicyAPI')
+
+/**
+ * GET /api/organizations/[id]/sso-policy
+ * Returns whether members must sign in through the organization's identity
+ * provider. Readable by any member.
+ */
+export const GET = withRouteHandler(
+  async (_request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const { id: organizationId } = await params
+
+    const [memberEntry] = await db
+      .select({ id: member.id })
+      .from(member)
+      .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+      .limit(1)
+
+    if (!memberEntry) {
+      return NextResponse.json(
+        { error: 'Forbidden - Not a member of this organization' },
+        { status: 403 }
+      )
+    }
+
+    const [org] = await db
+      .select({ requireSso: organization.requireSso })
+      .from(organization)
+      .where(eq(organization.id, organizationId))
+      .limit(1)
+
+    if (!org) {
+      return NextResponse.json({ error: 'Organization not found' }, { status: 404 })
+    }
+
+    return NextResponse.json({
+      success: true,
+      data: {
+        requireSso: org.requireSso,
+        hasVerifiedProvider: await hasSignInCapableSsoProvider(organizationId),
+      },
+    })
+  }
+)
+
+/**
+ * PUT /api/organizations/[id]/sso-policy
+ * Turns the single sign-on requirement on or off. The policy is read when a
+ * session is created, so a change never ends a session that already exists —
+ * signing everyone out stays the separate revoke action. Requires enterprise
+ * entitlement and an owner/admin role.
+ */
+export const PUT = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(updateOrganizationSsoPolicyContract, request, context, {
+      validationErrorResponse: (err) => validationErrorResponse(err, 'Invalid request body'),
+    })
+    if (!parsed.success) return parsed.response
+
+    const { id: organizationId } = parsed.data.params
+    const { requireSso } = parsed.data.body
+
+    const [memberEntry] = await db
+      .select({ role: member.role })
+      .from(member)
+      .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+      .limit(1)
+
+    if (!memberEntry) {
+      return NextResponse.json(
+        { error: 'Forbidden - Not a member of this organization' },
+        { status: 403 }
+      )
+    }
+
+    if (!isOrgAdminRole(memberEntry.role)) {
+      return NextResponse.json(
+        {
+          error:
+            'Forbidden - Only organization owners and admins can change the single sign-on requirement',
+        },
+        { status: 403 }
+      )
+    }
+
+    const entitled = await isOrganizationFeatureEntitled(organizationId, isSsoEnabled)
+    if (!entitled) {
+      return NextResponse.json(
+        {
+          error: isBillingEnabled
+            ? 'Single Sign-On is available on Enterprise plans only'
+            : 'Single Sign-On is disabled. Set ENTERPRISE_ENABLED or SSO_ENABLED to enable it.',
+        },
+        { status: 403 }
+      )
+    }
+
+    const [currentOrg] = await db
+      .select({ name: organization.name })
+      .from(organization)
+      .where(eq(organization.id, organizationId))
+      .limit(1)
+
+    if (!currentOrg) {
+      return NextResponse.json({ error: 'Organization not found' }, { status: 404 })
+    }
+
+    const verifiedProvider = await hasSignInCapableSsoProvider(organizationId)
+    if (requireSso && !verifiedProvider) {
+      return NextResponse.json(
+        {
+          error: 'Add an identity provider on a verified domain before requiring single sign-on',
+        },
+        { status: 400 }
+      )
+    }
+
+    const [updated] = await db
+      .update(organization)
+      .set({ requireSso, updatedAt: new Date() })
+      .where(eq(organization.id, organizationId))
+      .returning({ id: organization.id })
+
+    if (!updated) {
+      return NextResponse.json({ error: 'Organization not found' }, { status: 404 })
+    }
+
+    invalidateSsoPolicyCache(organizationId)
+
+    logger.info('Updated organization single sign-on requirement', { organizationId, requireSso })
+
+    recordAudit({
+      workspaceId: null,
+      actorId: session.user.id,
+      action: AuditAction.ORGANIZATION_SSO_POLICY_UPDATED,
+      resourceType: AuditResourceType.ORGANIZATION,
+      resourceId: organizationId,
+      actorName: session.user.name ?? undefined,
+      actorEmail: session.user.email ?? undefined,
+      resourceName: currentOrg.name,
+      description: requireSso ? 'Required single sign-on' : 'Stopped requiring single sign-on',
+      metadata: { requireSso },
+      request,
+    })
+
+    return NextResponse.json({
+      success: true,
+      data: { requireSso, hasVerifiedProvider: verifiedProvider },
+    })
+  }
+)

apps/sim/app/oauth-error/page.tsx

@@ -1,4 +1,5 @@
 import type { Metadata } from 'next'
+import { SSO_REQUIRED_ERROR_CODE, SSO_REQUIRED_MESSAGE } from '@/lib/auth/sso-policy'
 import { DesktopHandoffShell } from '@/app/desktop/components/desktop-handoff-shell'
 
 export const metadata: Metadata = {
@@ -40,6 +41,11 @@ const FRIENDLY: Record<string, string> = {
    */
   account_not_linked:
     'An account already exists for this email address. Sign in using the method you originally signed up with.',
+  /**
+   * The person's organization requires single sign-on, so a social sign-in is
+   * refused. Retrying the same provider can never succeed — name the way in.
+   */
+  [SSO_REQUIRED_ERROR_CODE]: SSO_REQUIRED_MESSAGE,
   /** The provider returned no email claim, so there is nothing to sign in as. */
   email_not_found:
     'Your identity provider didn’t share an email address with us, so we couldn’t complete sign-in. Please contact your administrator.',