Identity and access (SSO)

Enterprise SSO is Clerk-backed, not a custom in-app IdP.

Supported provider enums (API/UI):

• google_workspace
• azure_ad
• okta

Backend maps these to Clerk SAML strategies (e.g. saml_google, saml_microsoft, saml_okta).

Admin workflow (Settings → Identity & SSO):

1. Choose provider and connection details
2. Verify domain ownership
3. Finalize connection
4. Optional: disable identity, revoke sessions, test login

End-user sign-in: /auth/enterprise-sso → IdP → /auth/sso-callback.

Requires NEXT_PUBLIC_CLERK_ENTERPRISE_ENABLED=true on the frontend.