IdP connections

✅ Verified

Against Axowl.Auth/EndPoints/IdpConnectionEndpoints.cs and Axowl.Core/Constants/Business/PricingConstants.cs — 2026-09-15.

Org-scoped (/api/org/{slug}/idp-connections, session-authenticated). An org can hold several active connections; each is routed by the sign-in email’s domain, and one connection with no domain acts as the default. History rows are kept (IsActive=false), never deleted.

Connection types

named-okta, named-entra, named-google, named-kakao, named-naver, custom-saml, custom-oidc (IdpConnectionEndpoints.cs:27). The named-* providers use the same OIDC payload/validation as custom-oidc — the brand label is preserved only for UI display.

Endpoints

Method · Route	Purpose	Source
GET “	connection (the default — no domain — else the newest) and connections[] (all active), plus limit (plan cap, -1 = unlimited) and used. OIDC client secrets are redacted (only oidc_client_secret_set is returned).	:46
POST “	Create or replace a connection (see rules below).	:79
POST /deactivate	Switch back to Axowl native login — turns every active connection off.	:336
POST /{connectionId}/deactivate	Turn one connection off; the others keep routing.	:365

Body (POST)

type (required), display_name, email_domain (routing; omit for the default connection), attribute_mapping, and id to replace a specific existing connection.

• OIDC (custom-oidc / named-*): oidc_discovery_url or manual oidc_issuer + oidc_authorization_endpoint + oidc_token_endpoint, plus client_id. If a discovery URL is given, the well-known doc is fetched and endpoints (and jwks_uri) are auto-filled. A blank client secret on replace reuses the replaced connection’s secret.
• SAML (custom-saml): saml_metadata_url or saml_metadata_xml or manual saml_sso_url + saml_entity_id + saml_certificate. A blank certificate on replace reuses the replaced connection’s.

Replace rules and gates

1. Which row is replaced: the id you name → else the active connection with the same email_domain → else the default (no-domain) connection. Only that row is deactivated; other customers’ SSO keeps working (:296).
2. A domain can route to one active connection only — 409 email_domain_in_use.
3. Enterprise SSO needs the Pro plan or higher — 403 UPGRADE_REQUIRED (feature: "sso").
4. Adding (not replacing) a connection counts against the plan cap — 403 UPGRADE_REQUIRED (feature: "sso_connections", with limit and current). Caps: Basic 0 · Pro 1 · Pro+ 3 · Business 10 · Enterprise unlimited (PricingConstants.Limits.SsoConnections).
5. named-kakao / named-naver require the Korean Package add-on — 402 ADDON_REQUIRED (:122). Existing Kakao/Naver connections are not cut off by this gate; it guards creation and replacement only.

Axowl-native fallback rule

There is no direct IdP→IdP switch. To change providers you deactivate (all, or the one connection), then configure the new one — this prevents email-mapping lockout. After deactivation, /idp/{slug}/login returns idp_not_configured and native login is active. A login page can ask GET /idp/{slug}/login-hint beforehand to learn whether the org has an IdP and of which type (see OIDC SSO).