Enterprise SSO

Configure OIDC SSO providers for fluide-admin and fluide-capital-admin.

Enterprise SSO

Operator checklist

1. Database

   Apply migrations including ssoProvider (0050_sso_provider.sql).

2. Redirect URI

   Set FLUIDE_AUTH_SSO_OIDC_REDIRECT_URI to the public callback URL, for example:

   https://auth.yourdomain.com/api/v1/auth/sso/callback

   Register the same URI in your IdP (Okta, Entra, Auth0).

3. Trusted origins

   Add IdP issuer origins to BETTER_AUTH_SSO_TRUSTED_ORIGINS (comma-separated).

4. Providers JSON

   Set FLUIDE_SSO_PROVIDERS_JSON to an array of:

   providerId, issuer, domain, clientId, clientSecret, optional pkce, scopes, mapping, allowedFluideClientId (fluide-admin or fluide-capital-admin).

5. SPAs

   Set NEXT_PUBLIC_FLUIDE_SSO_PROVIDER_ID to match providerId. OAuth fragments are consumed on /post-auth.

Endpoints

• POST /api/v1/auth/sso/authorize
• GET /api/v1/auth/sso/callback

JWT issuance uses the same fragment contract as social OAuth via JwtIssuerService.

API routing

SSO endpoints live under /api/v1/auth/sso/* on the same Fluide API base URL as other Auth routes (sandbox: https://test.api.fluidehr.com). No separate host or path prefix is required for Connect integrations.