Files
supabase/apps/studio/components/interfaces/Organization/SSO/AttributeMapping.tsx
Danny White 00afaeac73 feat(studio): Issuer field in SSO form (#46187)
> [!CAUTION]
> This new SSO field is UI-only until `oidc_issuer` is added to the
`config` object.

## What kind of change does this PR introduce?

Feature

## What is the current behavior?

The SAML SSO provider config form has no way to supply an OIDC Issuer
URL, which is required for enterprise-managed MCP authentication.

## What is the new behavior?

- Adds an **OIDC Issuer URL** field to the SAML SSO provider config form
(`/org/_/sso`) inside an "Advanced settings" collapsible.
- Minor UI touch-ups to that SSO form.

| After |
| --- |
| <img width="1434" height="2458" alt="94962"
src="https://github.com/user-attachments/assets/e56f83cd-6e30-4a3f-a78d-330fc053953a"
/> |

The `oidcIssuer` field is UI-only right now; it renders but does not
write. Before merging:

1. Add `oidc_issuer` to the SSO config API type (removes the `as any`
cast in `SSOConfig.tsx:219`)
2. Add `oidc_issuer: values.oidcIssuer || undefined` to the `onSubmit`
payload at `SSOConfig.tsx:183`
3. Wire the backend endpoint to persist and return the field


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* SSO settings now include an "Advanced settings" collapsible with an
OIDC issuer field.

* **UX / Bug Fixes**
* Small UI/description refinements in SSO forms and attribute-mapping
layouts.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46187?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Cemal Kilic <cemalkilic96@gmail.com>
Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com>
2026-06-09 16:07:17 +02:00

185 lines
4.9 KiB
TypeScript

import { UseFormReturn } from 'react-hook-form'
import { Button } from 'ui'
import { FormItemLayout } from 'ui-patterns/form/FormItemLayout/FormItemLayout'
import { SingleValueFieldArray } from 'ui-patterns/form/SingleValueFieldArray/SingleValueFieldArray'
import type { SSOConfigFormSchema } from './SSOConfig'
type ProviderAttribute = 'emailMapping' | 'userNameMapping' | 'firstNameMapping' | 'lastNameMapping'
type ProviderPreset = {
name: string
attributeMapping: {
keys: {
email?: { name: string }
user_name?: { name: string }
first_name?: { name: string }
last_name?: { name: string }
name_identifier?: { name: string }
}
}
}
const PROVIDER_PRESETS: ProviderPreset[] = [
{
name: 'GSuite',
attributeMapping: {
keys: {
email: {
name: 'email',
},
user_name: {
name: 'user_name',
},
first_name: {
name: 'first_name',
},
last_name: {
name: 'last_name',
},
},
},
},
{
name: 'Azure',
attributeMapping: {
keys: {
email: {
name: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
},
name_identifier: {
name: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier',
},
first_name: {
name: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',
},
last_name: {
name: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname',
},
},
},
},
{
name: 'Okta',
attributeMapping: {
keys: {
email: {
name: 'email',
},
user_name: {
name: 'user_name',
},
first_name: {
name: 'first_name',
},
last_name: {
name: 'last_name',
},
},
},
},
] as const
export const AttributeMapping = ({
form,
emailField,
userNameField,
firstNameField,
lastNameField,
}: {
form: UseFormReturn<SSOConfigFormSchema>
emailField: ProviderAttribute
userNameField: ProviderAttribute
firstNameField: ProviderAttribute
lastNameField: ProviderAttribute
}) => {
// Helper to apply a preset
function applyPreset(preset: ProviderPreset) {
const keys = preset.attributeMapping.keys
// Set each field if present in the preset, otherwise clear
form.setValue(emailField, [{ value: keys.email?.name ?? '' }], { shouldDirty: true })
form.setValue(userNameField, [{ value: keys.user_name?.name ?? '' }], { shouldDirty: true })
form.setValue(firstNameField, [{ value: keys.first_name?.name ?? '' }], { shouldDirty: true })
form.setValue(lastNameField, [{ value: keys.last_name?.name ?? '' }], { shouldDirty: true })
}
return (
<FormItemLayout
label="Attribute mapping"
layout="flex-row-reverse"
description={
<div className="flex flex-col gap-2">
<p>Map SSO attributes to user fields. Presets for supported identity providers:</p>
<div className="flex flex-wrap items-center gap-2">
{PROVIDER_PRESETS.map((preset) => (
<Button key={preset.name} type="outline" onClick={() => applyPreset(preset)}>
{preset.name}
</Button>
))}
</div>
</div>
}
className="gap-1"
>
<div className="grid w-full max-w-sm min-w-0 gap-3">
<MappingFieldArray form={form} fieldName={emailField} label="email" required />
<MappingFieldArray
form={form}
fieldName={userNameField}
label="user_name"
required={false}
/>
<MappingFieldArray
form={form}
fieldName={firstNameField}
label="first_name"
required={false}
/>
<MappingFieldArray
form={form}
fieldName={lastNameField}
label="last_name"
required={false}
/>
</div>
</FormItemLayout>
)
}
const MappingFieldArray = ({
form,
fieldName,
label,
required,
placeholder,
}: {
form: UseFormReturn<SSOConfigFormSchema>
fieldName: ProviderAttribute
label: string
required: boolean
placeholder?: string
}) => {
return (
<div className="w-full min-w-0 space-y-1">
<div className="flex items-center justify-between gap-2">
<span className="text-foreground-light">{label}</span>
{!required ? <span className="text-foreground-muted">Optional</span> : null}
</div>
<SingleValueFieldArray
control={form.control}
name={fieldName}
valueFieldName="value"
createEmptyRow={() => ({ value: '' })}
placeholder={placeholder ?? ''}
addLabel="Add another"
removeLabel={`Remove ${label} mapping`}
minimumRows={1}
inputAutoComplete="off"
rowsClassName="grid gap-2 w-full"
addButtonType="default"
addButtonClassName="w-auto self-start justify-self-start"
/>
</div>
)
}