Preflight an SSO provider configuration
Validates a CANDIDATE OAuth SSO provider configuration and writes nothing — no provider, no application-provider link, no application update. Returns whether the configuration is well-formed, whether the OIDC endpoints could be resolved, whether the identity provider accepted the client credentials, and whether the identity provider authorizes this deployment’s SSO callback as a redirect URI, plus the endpoints the checks used. Returns 200 even when a check does not pass; a 4xx means the request itself could not be evaluated. The tenant is resolved from the authenticated identity, never from the payload, and the client secret is never echoed back.
Authorizations
Bearer authentication. Send Authorization: Bearer .
Body
Candidate SSO Provider Configuration
SSOProviderConfigInput payload
#nosec G117 -- write-only credential, never echoed back in any response
Google, AzureAD, Okta, Custom "Google"
true
Domain is REQUIRED for Type=Okta and ignored otherwise: Casdoor derives an Okta provider's authorize, token and userinfo endpoints from it, and no constant can stand in because they are per-org. Either the org URL (https://.okta.com) or an authorization server base (https://.okta.com/oauth2/default) is accepted; the org URL is completed to its authorization server on write.
"https://your-org.okta.com"
Response
OK
SSOProviderPreflight payload
"https://accounts.google.com/o/oauth2/v2/auth"
RedirectUriAcceptedByIdp reports whether the identity provider redirected the probe back to this deployment's SSO callback. RFC 6749 §3.1.2.4 forbids an authorization server from redirecting to an unregistered redirect_uri, so a redirect that arrives proves the callback is authorized. False means "not proven": an unreachable authorization endpoint, a reply carrying no Location and any other inconclusive answer all read false, so read it as not confirmed rather than as proof the callback is absent from the provider's authorized-redirect list.
"https://oauth2.googleapis.com/token"
"https://openidconnect.googleapis.com/v1/userinfo"