improvement(sso): verified multi-provider flow and cleaner provider settings

- Registration guard uses the same domain expression as sign-in resolution and domain verification
- Self-host registration script stores the normalized provider domain
- Sign-in reports "no provider" only on 404; other failures keep the generic message
- Settings: canonical back slot and title on provider detail and form, Edit then Delete, no duplicate Open in the row menu, awaited list refetch before navigating, replace-history on close, unsaved-changes guard on back
- Docs: state that an organization can use more than one identity provider

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/sso.mdx

@@ -8,7 +8,7 @@ import { Tab, Tabs } from 'fumadocs-ui/components/tabs'
 import { FAQ } from '@/components/ui/faq'
 import { Image } from '@/components/ui/image'
 
-Single Sign-On lets your team sign in to Sim through your company's identity provider instead of managing separate passwords. Sim supports both OIDC and SAML 2.0.
+Single Sign-On lets your team sign in to Sim through your company's identity provider instead of managing separate passwords. Sim supports both OIDC and SAML 2.0, and an organization can use more than one identity provider at a time, one per verified domain.
 
 ---
 

apps/sim/app/api/auth/sso/register/route.ts

@@ -193,7 +193,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           providerId: ssoProvider.providerId,
         })
         .from(ssoProvider)
-        .where(sql`lower(${ssoProvider.domain}) = ${domain}`)
+        .where(sql`lower(regexp_replace(btrim(${ssoProvider.domain}), '^\\*\\.', '')) = ${domain}`)
       if (claims.some((provider) => !isOwnedByCaller(provider))) {
         logger.warn('Rejected SSO registration for domain owned by another tenant', {
           domain,

apps/sim/ee/sso/components/sso-form.test.tsx

@@ -64,6 +64,7 @@ vi.mock('@/lib/core/config/env', () => ({
   isFalsy: (value: unknown) => value === undefined || value === 'false',
 }))
 
+import { ApiClientError } from '@/lib/api/client/errors'
 import SSOForm from '@/ee/sso/components/sso-form'
 
 function renderFirstFrame(search: string, registrationDisabled = false): string {
@@ -185,7 +186,9 @@ describe('SSOForm sign-in errors', () => {
   })
 
   it('explains when no provider serves the domain, without starting a sign-in', async () => {
-    mockRequestJson.mockRejectedValue(new Error('No identity provider is configured'))
+    mockRequestJson.mockRejectedValue(
+      new ApiClientError({ status: 404, message: 'No identity provider is configured', body: {} })
+    )
     renderInteractive('email=user%40nowhere.test')
 
     await submitForm()
@@ -196,6 +199,19 @@ describe('SSOForm sign-in errors', () => {
     expect(submitButton?.disabled).toBe(false)
   })
 
+  it('keeps the generic message when resolution fails for another reason', async () => {
+    mockRequestJson.mockRejectedValue(
+      new ApiClientError({ status: 429, message: 'Too many requests', body: {} })
+    )
+    renderInteractive('email=user%40example.com')
+
+    await submitForm()
+
+    expect(container).toHaveTextContent('Unable to start SSO. Check your email and try again.')
+    expect(container).not.toHaveTextContent('No SSO provider is configured')
+    expect(mockSsoSignIn).not.toHaveBeenCalled()
+  })
+
   it('shows a generic retryable error when Better Auth resolves with a 404', async () => {
     mockSsoSignIn.mockResolvedValue({
       data: null,

apps/sim/ee/sso/components/sso-form.tsx

@@ -5,6 +5,7 @@ import { Button, cn, Input, Label } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
 import Link from 'next/link'
 import { useSearchParams } from 'next/navigation'
+import { isApiClientError } from '@/lib/api/client/errors'
 import { requestJson } from '@/lib/api/client/request'
 import { resolveSsoProviderContract } from '@/lib/api/contracts/auth'
 import { client } from '@/lib/auth/auth-client'
@@ -17,7 +18,7 @@ import { AuthFormMessage, AuthSubmitButton } from '@/app/(auth)/components'
 const logger = createLogger('SSOForm')
 const SSO_SIGN_IN_ERROR = 'Unable to start SSO. Check your email and try again.'
 const SSO_NO_PROVIDER_ERROR =
-  'No SSO provider is configured for this email domain. Ask your administrator, or sign in another way.'
+  'No SSO provider is configured for this email domain. Ask your administrator.'
 const SSO_ERROR_MESSAGES = {
   account_not_found: 'No account found. Please contact your administrator to set up SSO access.',
   sso_failed: 'SSO authentication failed. Please try again.',
@@ -139,19 +140,14 @@ function SSOFormContent({
     try {
       const safeCallbackUrl = callbackUrl
 
-      /**
-       * The provider is named explicitly. Letting the SSO plugin choose by
-       * domain is unordered and blind to domain verification, so an
-       * organization with several providers would be routed arbitrarily.
-       */
-      const resolved = await requestJson(resolveSsoProviderContract, {
-        body: { email: emailValue },
-      }).catch((error: unknown) => {
-        logger.warn('No SSO provider resolved for address', { error })
-        return null
-      })
-      if (!resolved) {
-        setFormError(SSO_NO_PROVIDER_ERROR)
+      /** Named explicitly; see `resolveSsoProviderContract` for why the domain lookup is not trusted. */
+      let resolved: { providerId: string }
+      try {
+        resolved = await requestJson(resolveSsoProviderContract, { body: { email: emailValue } })
+      } catch (error) {
+        const noProvider = isApiClientError(error) && error.status === 404
+        if (!noProvider) logger.error('SSO provider resolution failed', { error })
+        setFormError(noProvider ? SSO_NO_PROVIDER_ERROR : SSO_SIGN_IN_ERROR)
         return
       }
 

apps/sim/ee/sso/components/sso-provider-list.tsx

@@ -12,6 +12,7 @@ import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/componen
 interface SsoProviderListProps {
   providers: SsoProviderView[]
   active: boolean
+  docsLink: string
   onAdd: () => void
   onOpen: (providerId: string) => void
   onDelete: (providerId: string) => void
@@ -29,11 +30,13 @@ export function SsoProviderList({
   onAdd,
   onOpen,
   onDelete,
+  docsLink,
 }: SsoProviderListProps) {
   return (
     <>
       {active && (
         <SettingsPanel
+          docsLink={docsLink}
           actions={[{ text: 'Add identity provider', variant: 'primary', onSelect: onAdd }]}
         />
       )}
@@ -54,7 +57,6 @@ export function SsoProviderList({
                   <RowActionsMenu
                     label={`${providerId} actions`}
                     actions={[
-                      { label: 'Open', onSelect: () => onOpen(providerId) },
                       { label: 'Delete', onSelect: () => onDelete(providerId), destructive: true },
                     ]}
                   />