fix(sso): harden provisioning edge cases

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/sso.mdx

@@ -272,7 +272,7 @@ Once SSO is configured, users with your domain (`company.com`) can sign in throu
 5. If **Member provisioning** is **Automatic**, Sim adds them to the organization as a Member, growing a Team seat count or validating available fixed-seat capacity
 6. They land in an accessible workspace, or see a clear no-access state until an admin grants workspace access
 
-With **Automatic** provisioning, no invitation is required for organization membership. The join follows the organization's seat policy and does not infer a role from IdP claims: every new user starts as a Member. Team subscriptions grow their billed seat count with membership; fixed-seat plans reject the join when capacity is full. With **Invite only**, SSO proves identity but an invitation is still required for organization or workspace access.
+With **Automatic** provisioning, no invitation is required for organization membership. The join follows the organization's seat policy and does not infer a role from IdP claims: every newly provisioned user starts as a Member. Team subscriptions grow their billed seat count with membership; fixed-seat plans reject the join when capacity is full. With **Invite only**, SSO proves identity but does not create new membership or workspace access; new access must be granted separately, while existing organization membership and workspace access remain available.
 
 <Callout type="warning">
   Sign-in must start from Sim. Launching from your identity provider's app portal (Microsoft's **My Apps**, Okta's dashboard tile) sends an unsolicited assertion, which Sim rejects. This is deliberate — accepting them would let anyone replay an assertion into your tenant — but it means an IdP-initiated test fails even when the configuration is correct.

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -324,6 +324,35 @@ describe('POST /api/auth/sso/register', () => {
     })
   })
 
+  it('reverts the config and provisioning mode when the trust write fails', async () => {
+    queueMembers([{ organizationId: 'org1', role: 'owner' }])
+    queueProviders([])
+    queueTableRows(schemaMock.ssoProvider, [
+      {
+        id: 'p1',
+        issuer: 'https://old-issuer.example.com',
+        domain: 'acme.com',
+        oidcConfig: '{"stored":"oidc"}',
+        samlConfig: null,
+        jitProvisioningEnabled: true,
+      },
+    ])
+    dbChainMockFns.returning.mockRejectedValueOnce(new Error('trust write failed'))
+
+    const res = await POST(request({ ...OIDC_BODY, orgId: 'org1', jitProvisioningEnabled: false }))
+
+    expect(res.status).toBe(500)
+    expect(mockUpdateSSOProvider).toHaveBeenCalledTimes(1)
+    expect(dbChainMockFns.set).toHaveBeenCalledWith({
+      issuer: 'https://old-issuer.example.com',
+      domain: 'acme.com',
+      oidcConfig: '{"stored":"oidc"}',
+      samlConfig: null,
+      domainVerified: false,
+      jitProvisioningEnabled: true,
+    })
+  })
+
   it('does not mark domain-verified when the registration is rolled back', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     resetDbChainMock()

apps/sim/app/api/auth/sso/register/route.ts

@@ -675,6 +675,20 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     }
 
     if (existingOwnedProvider) {
+      const revertProviderUpdate = async (): Promise<void> => {
+        await db
+          .update(ssoProvider)
+          .set({
+            issuer: existingOwnedProvider.issuer,
+            domain: existingOwnedProvider.domain,
+            oidcConfig: existingOwnedProvider.oidcConfig,
+            samlConfig: existingOwnedProvider.samlConfig,
+            domainVerified: false,
+            jitProvisioningEnabled: existingOwnedProvider.jitProvisioningEnabled,
+          })
+          .where(eq(ssoProvider.id, existingOwnedProvider.id))
+      }
+
       await auth.api.updateSSOProvider({
         body: {
           providerId,
@@ -686,21 +700,30 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         headers,
       })
 
+      let domainTrustGranted: boolean
+      try {
+        domainTrustGranted = await grantProviderDomainTrust()
+      } catch (error) {
+        try {
+          await revertProviderUpdate()
+        } catch (rollbackError) {
+          logger.error('Failed to revert SSO provider after domain trust write failed', {
+            domain,
+            orgId,
+            providerId,
+            userId: session.user.id,
+            error,
+            rollbackError,
+          })
+        }
+        throw error
+      }
+
       // Restore the pre-update config and clear the flag together. Clearing alone
       // is not enough: re-verifying the domain now regrants trust automatically,
       // which would activate the very config this request reported as rejected.
-      if (!(await grantProviderDomainTrust())) {
-        await db
-          .update(ssoProvider)
-          .set({
-            issuer: existingOwnedProvider.issuer,
-            domain: existingOwnedProvider.domain,
-            oidcConfig: existingOwnedProvider.oidcConfig,
-            samlConfig: existingOwnedProvider.samlConfig,
-            domainVerified: false,
-            jitProvisioningEnabled: existingOwnedProvider.jitProvisioningEnabled,
-          })
-          .where(eq(ssoProvider.id, existingOwnedProvider.id))
+      if (!domainTrustGranted) {
+        await revertProviderUpdate()
         logger.warn('Reverted SSO update: domain verification was removed mid-write', {
           domain,
           orgId,

apps/sim/content/blog/enterprise/index.mdx

@@ -35,7 +35,7 @@ faq:
   - q: "Can Copilot be used without sending workflow data to an external AI service?"
     a: "Yes. Copilot can run entirely within a self-hosted deployment using your own LLM keys, so prompts containing context from your workflows, execution logs, and workspace configuration route directly to your chosen provider and never leave your network."
   - q: "What identity providers does Sim support for SSO, and what happens when an employee is deprovisioned?"
-    a: "Sim integrates with Okta, Azure AD (Entra ID), Google Workspace, OneLogin, Auth0, JumpCloud, Ping Identity, ADFS, and any SAML 2.0 or OIDC compliant identity provider. IdP deprovisioning blocks future authentication but does not currently remove Sim membership or revoke active Sim sessions, so offboarding must also remove or suspend access in Sim."
+    a: "Sim integrates with Okta, Azure AD (Entra ID), Google Workspace, OneLogin, Auth0, JumpCloud, Ping Identity, ADFS, and any SAML 2.0 or OIDC compliant identity provider. IdP deprovisioning blocks future SSO authentication but does not currently remove Sim membership or revoke active Sim sessions, so offboarding must also remove or suspend access in Sim."
 ---
 
 We've been working with security teams at larger organizations to bring Sim into environments with strict compliance and data handling requirements. This post covers the enterprise capabilities we've built: granular access control, bring-your-own-keys, self-hosted deployments, on-prem Copilot, SSO & SAML, whitelabeling, compliance, and programmatic management via the Admin API.
@@ -123,7 +123,7 @@ Integrate with your existing identity provider through SAML 2.0 or OIDC. We supp
 
 Once enabled, users authenticate through your IdP, so its MFA and sign-in policies apply to the authentication event. Sim sessions have their own lifecycle: IdP logout or deprovisioning does not currently revoke an active Sim session or remove organization membership, so those are explicit Sim admin steps during offboarding.
 
-Administrators choose how first-time users enter the organization. **Automatic** provisioning adds a user authenticated through the verified SSO connection as a Member and consumes a billed seat; Team seat counts grow with membership, while fixed-seat plans require available capacity. **Invite only** authenticates the user but requires an invitation for organization or workspace access. Automatic provisioning never promotes IdP claims into Sim roles and never grants workspace access implicitly.
+Administrators choose how first-time users enter the organization. For a user without a pending invitation or existing external workspace access, **Automatic** provisioning adds them through the verified SSO connection as a Member and consumes a billed seat; Team seat counts grow with membership, while fixed-seat plans require available capacity. **Invite only** authenticates the user but requires access to be granted separately. Existing membership and workspace access remain available. Automatic provisioning never promotes IdP claims into Sim roles and never grants workspace access implicitly.
 
 This centralizes your authentication and audit trail. Your security team's policies apply to Sim access through the same system that tracks everything else.
 

apps/sim/lib/auth/sso/application/admit-sso-user.test.ts

@@ -1,7 +1,15 @@
 /**
  * @vitest-environment node
  */
-import { auditMock, dbChainMock, queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
+import {
+  auditMock,
+  dbChainMock,
+  dbChainMockFns,
+  flattenMockConditions,
+  queueTableRows,
+  resetDbChainMock,
+  schemaMock,
+} from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
@@ -164,7 +172,10 @@ describe('SSO JIT admission', () => {
       kind: 'provisioning-disabled',
       organizationId: 'org-1',
     })
-    expect(mockAcquireOrganizationUserMutationLocks).not.toHaveBeenCalled()
+    expect(mockAcquireOrganizationUserMutationLocks).toHaveBeenCalledWith(dbChainMock.db, {
+      userId: 'user-1',
+      organizationIds: ['org-1'],
+    })
     expect(mockEnsureUserInOrganizationTx).not.toHaveBeenCalled()
   })
 
@@ -177,7 +188,10 @@ describe('SSO JIT admission', () => {
       organizationId: 'org-1',
       memberId: 'member-existing',
     })
-    expect(mockAcquireOrganizationUserMutationLocks).not.toHaveBeenCalled()
+    expect(mockAcquireOrganizationUserMutationLocks).toHaveBeenCalledWith(dbChainMock.db, {
+      userId: 'user-1',
+      organizationIds: ['org-1'],
+    })
     expect(mockEnsureUserInOrganizationTx).not.toHaveBeenCalled()
   })
 
@@ -213,6 +227,20 @@ describe('SSO JIT admission', () => {
     expect(mockEnsureUserInOrganizationTx).not.toHaveBeenCalled()
   })
 
+  it('only preserves external access from active workspaces', async () => {
+    queueIdentity()
+
+    await expect(execute()).resolves.toEqual({
+      kind: 'provisioned',
+      organizationId: 'org-1',
+      memberId: 'member-1',
+    })
+    const conditions = dbChainMockFns.where.mock.calls.flatMap(([condition]) =>
+      flattenMockConditions(condition)
+    )
+    expect(conditions).toContainEqual({ type: 'isNull', column: schemaMock.workspace.archivedAt })
+  })
+
   it('rejects a user who belongs to another organization', async () => {
     queueIdentity()
     queueTableRows(schemaMock.member, [{ id: 'member-other', organizationId: 'org-other' }])

apps/sim/lib/auth/sso/application/admit-sso-user.ts

@@ -13,7 +13,7 @@ import {
 import { createLogger } from '@sim/logger'
 import { normalizeSSODomain } from '@sim/utils/sso-domain'
 import { normalizeEmail } from '@sim/utils/string'
-import { and, desc, eq, gt, inArray, sql } from 'drizzle-orm'
+import { and, desc, eq, gt, inArray, isNull, sql } from 'drizzle-orm'
 import { applySessionPolicyToNewMember } from '@/lib/auth/session-policy'
 import { ssoJitAdmissionOperation } from '@/lib/auth/sso/application/operations'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
@@ -124,6 +124,12 @@ async function runAdmissionTransaction(
         result: { kind: 'organization-not-bound', organizationId: null },
       }
     }
+
+    await acquireOrganizationUserMutationLocks(tx, {
+      userId,
+      organizationIds: [provider.organizationId],
+    })
+
     if (!provider.jitProvisioningEnabled) {
       const [sameOrganization] = await tx
         .select({ id: member.id })
@@ -149,11 +155,6 @@ async function runAdmissionTransaction(
       }
     }
 
-    await acquireOrganizationUserMutationLocks(tx, {
-      userId,
-      organizationIds: [provider.organizationId],
-    })
-
     const memberships = await tx
       .select({ id: member.id, organizationId: member.organizationId })
       .from(member)
@@ -195,7 +196,11 @@ async function runAdmissionTransaction(
           and(eq(permissions.entityType, 'workspace'), eq(permissions.entityId, workspace.id))
         )
         .where(
-          and(eq(permissions.userId, userId), eq(workspace.organizationId, provider.organizationId))
+          and(
+            eq(permissions.userId, userId),
+            eq(workspace.organizationId, provider.organizationId),
+            isNull(workspace.archivedAt)
+          )
         )
         .limit(1),
     ])