Document multi-ingress SSO in multi-ingress tutorial

[supersven]

• Must land after Document account-pages' multi-ingress configuration wire-server#5568 , with an updated wire-server submodule.

Ticket: https://wearezeta.atlassian.net/browse/WPB-28532

Change type

• Documentation change
• Build pipeline change
• Submodule update
• Deployment change

Basic information

• THIS CHANGE REQUIRES A WIRE-DOCS RELEASE NOW

Testing

• I ran/applied the changes myself, in a test environment. (I took the values from the galaxy/multi-ingress test environment. However, there may be dragons.)

Tracking

• I mentioned this PR in Jira, OR I mentioned the Jira ticket in this PR.
• I mentioned this PR in one of the issues attached to one of our repositories.

[Copilot]

Copilot review overview

🟡 Changes recommended

The Spar example cannot render without required contacts, and critical cross-IdP security requirements are omitted.

Review effort: Balanced
Findings: 1 · 1 · 1

Open (3)

• Add required contacts to every domainConfigs entry · New
• Document cross-IdP fallback security preconditions · New
• Add account-pages section to Multi-Ingress table of contents · New

What changed in this PR

Extends multi-ingress documentation to support SAML SSO and account pages.

Changes:

• Documents Spar multi-domain SSO configuration and certificate allowlisting.
• Adds account-pages configuration and deployment instructions.
• Updates webapp and ingress examples.

File	Description
src/​how-to/​install/​multi-ingress.md	Expands multi-ingress setup guidance for SSO, account pages, and federation constraints.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The Entra URL and SSO eligibility guidance are inaccurate, and the required submodule update is missing.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Update wire-server submodule for new account-pages anchor · New
• Add appid to Microsoft Entra metadata URL · New
• Correct documentation to include all activated SSO users · New
• Add account-pages section to Multi-Ingress table of contents

Resolved since last review (2)

• Add required contacts to every domainConfigs entry
• Document cross-IdP fallback security preconditions

[Copilot]

Copilot review overview

🟡 Changes recommended

The missing submodule update leaves a broken reference, and the SSO version and certificate extraction guidance need correction.

Review effort: Balanced
Findings: 1 · 3 · 3

Open (7)

• Use namespace-aware parsing for signing certificates · New
• Raise the tutorial's minimum supported backend version · New
• Add appid to Microsoft Entra metadata URL
• Update wire-server submodule for new account-pages anchor
• Fix grammatical errors in the updated note · New
• Correct documentation to include all activated SSO users
• Add account-pages section to Multi-Ingress table of contents

[Copilot]

Copilot review overview

🟡 Changes recommended

The required submodule update is missing, one internal link is broken, and the fingerprint commands produce unusable values.

Review effort: Balanced
Findings: 2

Open (2)

• Relative config-options link is missing .md extension · New
• Certificate fingerprint output includes whitespace and OpenSSL prefix · New

Resolved since last review (7)

• Use namespace-aware parsing for signing certificates
• Raise the tutorial's minimum supported backend version
• Add appid to Microsoft Entra metadata URL
• Update wire-server submodule for new account-pages anchor
• Fix grammatical errors in the updated note
• Correct documentation to include all activated SSO users
• Add account-pages section to Multi-Ingress table of contents

[Copilot]

Copilot review overview

🔵 Needs a closer look

The documented version is unavailable and the required wire-server submodule update is missing.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Certificate fingerprint output includes whitespace and OpenSSL prefix
• Relative config-options link is missing .md extension

Previously missed (1)

In code that hasn't changed since last review

Replace semicolon with “otherwise,”

src/​how-to/​install/​multi-ingress.md:259

The semicolon cannot introduce the dependent phrase “as otherwise.” Use “otherwise,” directly so the recommendation reads grammatically.

This issue also appears in the following locations of the same file:

• line 342
• line 372