{"action":"closed","issue":{"url":"https://api.github.com/repos/getsentry/sentry/issues/1439","labels_url":"https://api.github.com/repos/getsentry/sentry/issues/1439/labels{/name}","comments_url":"https://api.github.com/repos/getsentry/sentry/issues/1439/comments","events_url":"https://api.github.com/repos/getsentry/sentry/issues/1439/events","html_url":"https://github.com/getsentry/sentry/issues/1439","id":58949678,"number":1439,"title":"SSO Preview Phase","user":{"login":"dcramer","id":23610,"avatar_url":"https://avatars.githubusercontent.com/u/23610?v=3","gravatar_id":"","url":"https://api.github.com/users/dcramer","html_url":"https://github.com/dcramer","followers_url":"https://api.github.com/users/dcramer/followers","following_url":"https://api.github.com/users/dcramer/following{/other_user}","gists_url":"https://api.github.com/users/dcramer/gists{/gist_id}","starred_url":"https://api.github.com/users/dcramer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcramer/subscriptions","organizations_url":"https://api.github.com/users/dcramer/orgs","repos_url":"https://api.github.com/users/dcramer/repos","events_url":"https://api.github.com/users/dcramer/events{/privacy}","received_events_url":"https://api.github.com/users/dcramer/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/getsentry/sentry/labels/Accepted","name":"Accepted","color":"207de5"},{"url":"https://api.github.com/repos/getsentry/sentry/labels/getsentry.com","name":"getsentry.com","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"dcramer","id":23610,"avatar_url":"https://avatars.githubusercontent.com/u/23610?v=3","gravatar_id":"","url":"https://api.github.com/users/dcramer","html_url":"https://github.com/dcramer","followers_url":"https://api.github.com/users/dcramer/followers","following_url":"https://api.github.com/users/dcramer/following{/other_user}","gists_url":"https://api.github.com/users/dcramer/gists{/gist_id}","starred_url":"https://api.github.com/users/dcramer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcramer/subscriptions","organizations_url":"https://api.github.com/users/dcramer/orgs","repos_url":"https://api.github.com/users/dcramer/repos","events_url":"https://api.github.com/users/dcramer/events{/privacy}","received_events_url":"https://api.github.com/users/dcramer/received_events","type":"User","site_admin":false},"milestone":null,"comments":20,"created_at":"2015-02-25T18:41:21Z","updated_at":"2015-07-21T07:31:01Z","closed_at":"2015-07-21T07:31:01Z","body":"The basics for the SSO framework have landed in master, and now we need to expand on a few things.\r\n\r\nSpecifically, we need to target the tighter security controls around membership.\r\n\r\n- [x] Your membership will be considered inactive if you do not have an SSO-linked identity\r\n- [x] Verification should be reset when the auth provider is removed\r\n- [ ] Inviting a team member should force them through the SSO login flow\r\n- [x] The ability to send a existing member a \"link your account\" email\r\n- [x] Loading indicator for 'resend invite' link\r\n- [x] The ability to send all members who have no SSO identity a \"link your account email\"\r\n- [x] Visual changes to membership list to suggest which accounts are unlinked and thus inactive\r\n- [ ] Google should have a clear path to \"I authenticated with the wrong domain, I need to fix it\"\r\n- [ ] Unlinking your provider currently wipes all identities. This isn't ideal, but without adjusting AuthIdentity to have some additional configuration there's not much we can do. Either way, we should at least inform the user this will happen.\r\n- [ ] The ability to upload an icon for your organization which will be used on the SSO page\r\n- [x] SSO sessions need a strict expiration, and identities themselves should contain the last time they were verified\r\n- [x] Google should request offline access and periodically verify based on the provider sync time\r\n- [ ] Organization owners (at least by default) should be able to bypass the sso:linked check\r\n- [x] Members who have not linked SSO should have an alert somewhere in the app that allows them to quickly do so (since they no longer have org access)\r\n- [ ] Link emails should have a rich HTML template\r\n- [ ] Organization members which have been invalidated should be moved to an inactive state (something that is visually different than the 'sso is not linked', though they should still share that flag).\r\n- [x] OAuth / Google needs to implement refresh tokens, and correctly account for these in the offline validation\r\n- [ ] If you are unable to authenticate (i.e. you dont have an @domain.com account on Google), we should not continually loop you through the org SSO page.\r\n- [ ] When you are already logged in, the \"login to Organization\" page should allow you to create a new account or link with your existing account\r\n- [ ] You should be able to merge accounts (somehow)\r\n\r\nThere are also next to no tests so it's a painful manual QA process atm. We should fix this by building a dummy SSO provider in the test suite (i.e. something that just redirects back) and create an integration test suite out of it."}}