Company SSO (OpenID Connect)

Authorization code with PKCE, state, nonce and RSA-signed ID token validation. Discovery, token and JWKS endpoints must share the HTTPS issuer origin. Accounts are linked to exact provider subjects; email matching and automatic provisioning are disabled. Local MFA is optional; enabled authenticators are challenged after SSO.

@csrf

Register each host-specific redirect URI: https://YOUR-HOST/sso/{{ app(\App\Domain\Identity\TenantContext::class)->tenant()->slug }}/callback. Login sessions stay on that host.

@if($sso)
@csrf

SSO login: /sso/{{ app(\App\Domain\Identity\TenantContext::class)->tenant()->slug }}/start

@csrf
@php($uissoidentities=\App\Support\ListView::rows($identities,'sso_identities'))@foreach($uissoidentities as $i)

User #{{ $i->user_id }} ยท {{ $i->subject }}

@csrf
@endforeach @endif