feat(enterprise): add SSO enforcement mode with break-glass admin

apps/api/src/index.ts

@@ -21,6 +21,7 @@ import { shouldRunStartupCleanup } from "./lib/cleanup.js";
 import { buildCsp } from "./lib/csp.js";
 import { ensureAiDirs, recoverInterruptedInstalls } from "./lib/feature-status.js";
 
+import { getSettingString } from "./lib/settings-helpers.js";
 import { requirePermission } from "./permissions.js";
 import {
   authMiddleware,
@@ -438,6 +439,8 @@ app.get("/api/v1/config/auth", async () => {
     config.samlLoginUrl = "/api/auth/saml/login";
   }
 
+  config.ssoEnforced = (await getSettingString("ssoEnforcement", "false")) === "true";
+
   return config;
 });
 

apps/api/src/plugins/auth.ts

@@ -283,6 +283,28 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
         return reply.status(403).send({ error: "Authentication is disabled" });
       }
 
+      // SSO enforcement check
+      const ssoEnforced = await getSettingString("ssoEnforcement", "false");
+      if (ssoEnforced === "true") {
+        let isEnabled = false;
+        try {
+          const { isFeatureEnabled } = await import("@snapotter/enterprise");
+          isEnabled = isFeatureEnabled("sso_enforcement");
+        } catch {}
+
+        if (isEnabled) {
+          const breakGlassUsername = await getSettingString("ssoBreakGlassUsername", "");
+          const { username } = loginSchema.parse(request.body);
+
+          if (username !== breakGlassUsername) {
+            return reply.status(403).send({
+              error: "Local password login is disabled. Please use SSO.",
+              code: "SSO_ENFORCED",
+            });
+          }
+        }
+      }
+
       const parsed = loginSchema.safeParse(request.body);
       if (!parsed.success) {
         return reply.status(400).send({ error: "Username and password are required" });

apps/web/src/hooks/use-auth.ts

@@ -16,6 +16,7 @@ interface AuthState {
   oidcProviderName: string | null;
   samlEnabled: boolean;
   samlProviderName: string | null;
+  ssoEnforced: boolean;
   loginMethod: string | null;
   hasLocalPassword: boolean;
 }
@@ -52,6 +53,7 @@ export function useAuth() {
     oidcProviderName: null,
     samlEnabled: false,
     samlProviderName: null,
+    ssoEnforced: false,
     loginMethod: null,
     hasLocalPassword: false,
   });
@@ -80,6 +82,7 @@ export function useAuth() {
               oidcProviderName: null,
               samlEnabled: false,
               samlProviderName: null,
+              ssoEnforced: false,
               loginMethod: null,
               hasLocalPassword: false,
             });
@@ -110,6 +113,7 @@ export function useAuth() {
               oidcProviderName: config.oidcProviderName ?? null,
               samlEnabled: config.samlEnabled ?? false,
               samlProviderName: config.samlProviderName ?? null,
+              ssoEnforced: config.ssoEnforced ?? false,
               loginMethod: session.user?.loginMethod ?? null,
               hasLocalPassword: session.user?.hasLocalPassword ?? false,
             });
@@ -130,6 +134,7 @@ export function useAuth() {
               oidcProviderName: config.oidcProviderName ?? null,
               samlEnabled: config.samlEnabled ?? false,
               samlProviderName: config.samlProviderName ?? null,
+              ssoEnforced: config.ssoEnforced ?? false,
               loginMethod: null,
               hasLocalPassword: false,
             });

apps/web/src/pages/login-page.tsx

@@ -127,7 +127,7 @@ function LanguageSelector() {
 
 export function LoginPage() {
   const { t } = useTranslation();
-  const { oidcEnabled, oidcProviderName, samlEnabled, samlProviderName } = useAuth();
+  const { oidcEnabled, oidcProviderName, samlEnabled, samlProviderName, ssoEnforced } = useAuth();
   const [searchParams] = useSearchParams();
   const [username, setUsername] = useState("");
   const [password, setPassword] = useState("");
@@ -191,7 +191,35 @@ export function LoginPage() {
             </h1>
             <h2 className="text-2xl font-bold mt-4 text-foreground">{t.auth.login}</h2>
           </div>
-          <form onSubmit={handleSubmit} className="space-y-4">
+          {ssoEnforced && (oidcEnabled || samlEnabled) && (
+            <div className="space-y-3">
+              {oidcEnabled && (
+                <a
+                  href="/api/auth/oidc/login"
+                  className="w-full py-3 rounded-lg bg-primary/80 text-primary-foreground font-medium hover:bg-primary transition-colors flex items-center justify-center gap-2"
+                >
+                  {format(t.auth.signInWith, { provider: oidcProviderName || "SSO" })}
+                </a>
+              )}
+              {samlEnabled && (
+                <a
+                  href="/api/auth/saml/login"
+                  className="w-full py-3 rounded-lg bg-primary/80 text-primary-foreground font-medium hover:bg-primary transition-colors flex items-center justify-center gap-2"
+                >
+                  {format(t.auth.signInWith, { provider: samlProviderName || "SSO" })}
+                </a>
+              )}
+              <div className="flex items-center gap-3 my-4">
+                <div className="flex-1 border-t border-border" />
+                <span className="text-sm text-muted-foreground">{t.auth.or}</span>
+                <div className="flex-1 border-t border-border" />
+              </div>
+              <p className="text-sm text-muted-foreground text-center">
+                {t.auth.ssoEnforcedLocalRestricted}
+              </p>
+            </div>
+          )}
+          <form onSubmit={handleSubmit} className={`space-y-4${ssoEnforced ? " opacity-60" : ""}`}>
             <div>
               <label htmlFor="username" className="block text-sm font-medium mb-1 text-foreground">
                 {t.auth.username}
@@ -233,7 +261,7 @@ export function LoginPage() {
               {loading ? t.auth.loggingIn : t.auth.loginButton}
             </button>
           </form>
-          {(oidcEnabled || samlEnabled) && (
+          {!ssoEnforced && (oidcEnabled || samlEnabled) && (
             <>
               <div className="flex items-center gap-3 my-4">
                 <div className="flex-1 border-t border-border" />

packages/shared/src/i18n/ar.ts

@@ -3001,6 +3001,7 @@ export const ar: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "يتم إدارة تغيير كلمة المرور بواسطة مزود الهوية الخاص بك.",
     enterUsername: "أدخل اسم المستخدم",

packages/shared/src/i18n/de.ts

@@ -3028,6 +3028,7 @@ export const de: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider:
       "Passwortaenderungen werden von Ihrem Identitaetsanbieter verwaltet.",

packages/shared/src/i18n/en.ts

@@ -2967,6 +2967,7 @@ export const en = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "Password changes are managed by your identity provider.",
     enterUsername: "Enter username",

packages/shared/src/i18n/es.ts

@@ -3006,6 +3006,7 @@ export const es: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider:
       "Los cambios de contrasena son administrados por tu proveedor de identidad.",

packages/shared/src/i18n/fr.ts

@@ -3026,6 +3026,7 @@ export const fr: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider:
       "Les modifications de mot de passe sont gerees par votre fournisseur d'identite.",

packages/shared/src/i18n/hi.ts

@@ -2998,6 +2998,7 @@ export const hi: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "पासवर्ड बदलाव आपके आइडेंटिटी प्रोवाइडर द्वारा प्रबंधित किए जाते हैं।",
     enterUsername: "यूज़रनेम दर्ज करें",

packages/shared/src/i18n/id.ts

@@ -3014,6 +3014,7 @@ export const id: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "Perubahan kata sandi dikelola oleh penyedia identitas Anda.",
     enterUsername: "Masukkan nama pengguna",

packages/shared/src/i18n/it.ts

@@ -3020,6 +3020,7 @@ export const it: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider:
       "Le modifiche alla password sono gestite dal tuo provider di identita.",

packages/shared/src/i18n/ja.ts

@@ -2971,6 +2971,7 @@ export const ja: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "パスワードはIDプロバイダーで管理されています。",
     enterUsername: "ユーザー名を入力",

packages/shared/src/i18n/ko.ts

@@ -2956,6 +2956,7 @@ export const ko: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "비밀번호는 ID 제공자에서 관리됩니다.",
     enterUsername: "사용자명 입력",

packages/shared/src/i18n/nl.ts

@@ -3017,6 +3017,7 @@ export const nl: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "Wachtwoordwijzigingen worden beheerd door je identiteitsprovider.",
     enterUsername: "Voer gebruikersnaam in",

packages/shared/src/i18n/pl.ts

@@ -3024,6 +3024,7 @@ export const pl: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "Zarządzanie hasłem odbywa się przez dostawcę tożsamości.",
     enterUsername: "Wprowadź nazwę użytkownika",

packages/shared/src/i18n/pt-BR.ts

@@ -3017,6 +3017,7 @@ export const ptBR: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider:
       "Alteracoes de senha sao gerenciadas pelo seu provedor de identidade.",

packages/shared/src/i18n/ru.ts

@@ -3016,6 +3016,7 @@ export const ru: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "Управление паролем осуществляется Вашим провайдером идентификации.",
     enterUsername: "Введите имя пользователя",

packages/shared/src/i18n/sv.ts

@@ -3012,6 +3012,7 @@ export const sv: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "Losenordsandringar hanteras av din identitetsleverantor.",
     enterUsername: "Ange anvandarnamn",

packages/shared/src/i18n/th.ts

@@ -2989,6 +2989,7 @@ export const th: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "การเปลี่ยนรหัสผ่านจัดการโดยผู้ให้บริการยืนยันตัวตนของคุณ",
     enterUsername: "กรอกชื่อผู้ใช้",

packages/shared/src/i18n/tr.ts

@@ -3020,6 +3020,7 @@ export const tr: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider:
       "Parola değişiklikleri kimlik sağlayıcınız tarafından yönetilmektedir.",

packages/shared/src/i18n/uk.ts

@@ -3017,6 +3017,7 @@ export const uk: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "Керування паролем здійснюється Вашим постачальником ідентифікації.",
     enterUsername: "Введіть ім'я користувача",

packages/shared/src/i18n/vi.ts

@@ -3012,6 +3012,7 @@ export const vi: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "Việc đổi mật khẩu được quản lý bởi nhà cung cấp danh tính của bạn.",
     enterUsername: "Nhập tên đăng nhập",

packages/shared/src/i18n/zh-CN.ts

@@ -2941,6 +2941,7 @@ export const zhCN: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "密码修改由您的身份提供商管理。",
     enterUsername: "输入用户名",

packages/shared/src/i18n/zh-TW.ts

@@ -2939,6 +2939,7 @@ export const zhTW: TranslationKeys = {
     samlUserNotAuthorized:
       "Your account is not authorized to access this application. Contact your administrator.",
     samlUserLimitReached: "User limit reached. Contact your administrator.",
+    ssoEnforcedLocalRestricted: "Local login is restricted to authorized administrators.",
     methodSaml: "SAML",
     passwordManagedByProvider: "密碼由您的身分提供者管理。",
     enterUsername: "輸入使用者名稱",