mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-13 22:03:13 -06:00
4bc0d433b0
The README described what SSO is and which variables exist. It did not say where
to click, which of the several plausible values to use, or what any failure
means -- so configuring it meant reading source, and every wrong turn produced an
error code with no stated cause.
docs/sso-setup.md walks both audiences: the operator wiring up Google or
Microsoft for the instance, and an organization admin bringing their own
provider and proving a domain. Written from doing it end to end against real
Google and Entra tenants, so the traps in it are the ones actually hit rather
than the ones imagined:
- MICROSOFT_TENANT_ID is the directory that AUTHENTICATES the user, not the
one the app registration lives in. For personal accounts those differ, and
using the visible Directory (tenant) ID fails every login with an error that
points at the tenant rather than at the setting;
- Web platform, not SPA -- a SPA registration is refused at the token endpoint
because the exchange is server-side and sends no Origin;
- a Web registration is a confidential client, so the secret is not optional;
- Entra needs the `email` optional claim added, or the token arrives with no
address and fails as no_email;
- Google's redirect URI matches byte for byte, and Testing publishing status
silently limits sign-in to listed test users.
Every error code the server can emit is in a table with its usual cause. Each
one was checked against the source rather than remembered, as were the variable
names and the DNS record format.
Also covers what the account rules mean in practice: linking deletes the
password, unlinking sets a new one in the same step, SSO-only clears passwords
irreversibly, and linking the platform admin makes that provider the only way
in.
|
||
|---|---|---|
| .. | ||
| 104-draft-preview-build-plan.md | ||
| 109-android-pip-visibility.md | ||
| 134-device-reporting.md | ||
| 146-hardening-fallout.md | ||
| 146-hardening-plan.md | ||
| 148-android-duplicate-socket-fix.md | ||
| 148-connection-lifecycle-analysis.md | ||
| 148-half-open-fix.md | ||
| 148-mass-disconnect-analysis.md | ||
| 148-server-eviction-storm-analysis.md | ||
| android-troubleshooting.md | ||
| billing-authz-plan.md | ||
| billing.md | ||
| device-owner-provisioning.md | ||
| local-ai-setup.md | ||
| maintenance-device-status-log.md | ||
| multi-tenancy-design.md | ||
| openapi.yaml | ||
| player-parity.md | ||
| seo-directory-listings.md | ||
| sso-setup.md | ||