Affects
Teams that configure Access Manager SSO, particularly single-tenant BYOC deployments with a fixed Casdoor organization.
What changed
The documentation now covers SSO provider preflight validation. Before saving a candidate provider, the check validates configuration, OIDC discovery, client credentials, and the callback redirect URI without creating or changing a provider, application-provider link, or application. It also documents
PLUGIN_AUTH_SSO_STATIC_ORGANIZATION for a single-tenant BYOC deployment with one fixed Casdoor organization. Pre-login SSO resolves requests to that organization instead of looking up an emaildomain: organization tag. Do not set this variable when MULTI_TENANT_ENABLED=true.
This entry documents the available behavior; it does not announce a runtime change.
Impact
Classification: Review recommended. Preflight can reduce configuration risk before an SSO provider is saved. The fixed-organization setting is only appropriate for a single-tenant deployment and is incompatible with multi-tenancy.
What you need to do
Use preflight validation before saving an SSO provider. If you operate a single-tenant BYOC deployment with one fixed organization, evaluate whether
PLUGIN_AUTH_SSO_STATIC_ORGANIZATION fits your setup. Never enable it with MULTI_TENANT_ENABLED=true.