Skip to content

Sso enterprise support#293

Closed
bigbearcool wants to merge 3 commits intodataelement:mainfrom
bigbearcool:sso-enterprise-support
Closed

Sso enterprise support#293
bigbearcool wants to merge 3 commits intodataelement:mainfrom
bigbearcool:sso-enterprise-support

Conversation

@bigbearcool
Copy link
Copy Markdown

Summary

Checklist

  • Tested locally
  • No unrelated changes included

园长 added 3 commits April 5, 2026 02:17
Problem:
- SSO login page only worked on the platform domain (bigbear.cool), not on tenant
  subdomains (e.g., acme.bigbear.cool)
- SSO callback URLs were constructed using PUBLIC_BASE_URL instead of the request
  Host header, causing callbacks to redirect to the wrong domain
- No way to create companies with custom slugs for branded SSO subdomain URLs
- Login page redirected to platform domain instead of staying on tenant subdomain
  after successful SSO authentication

Changes:
- backend/app/api/admin.py:
  - Add slug field to CompanyCreateRequest schema
  - Add CompanyUpdateRequest schema for updating company settings
  - Add PUT /companies/{company_id} endpoint for updating company SSO config
- backend/app/api/tenants.py:
  - Add slug field to TenantCreate schema
  - self_create_company: use custom slug if provided, else auto-generate
  - self_create_company: auto-assign sso_domain via platform_service.get_tenant_sso_base_url()
- backend/app/core/public_url.py: New utility file with:
  - get_public_base_url_sync(): sync version reads env var
  - get_public_base_url_async(): async version reads from database
  - get_sso_domain_from_slug(): generate subdomain URL from slug
- backend/alembic/versions/add_participants.py: Fix migration bug (username column doesn't exist)
- frontend/nginx.conf: Change server_name from "localhost" to "_" to accept
  requests from any hostname (required for tenant subdomains)
- frontend/vite.config.ts: Add allowedHosts for .clawith.ai and .bigbear.cool domains
- frontend/Dockerfile: Add VITE_PUBLIC_URL build arg
- frontend/src/pages/AdminCompanies.tsx:
  - Add newSlug state and slug input in Create Company form
  - Add editingCompany state and Edit button for each company
  - Add EditCompanyModal rendering when editingCompany is set
  - EditCompanyModal: add name and slug fields for editing
- frontend/src/services/api.ts:
  - Update createCompany type to include optional slug
  - Update updateCompany to use /admin/companies/{id} endpoint
- docker-compose.yml: Add VITE_PUBLIC_URL environment variable to frontend service

Features:
- Admin can specify custom slug when creating companies
- Admin can edit company name and slug via Edit button
- Admin can edit company settings including SSO configuration
- Self-service company creation auto-generates sso_domain
- SSO callbacks use correct tenant subdomain
- Enterprise users can login at tenant subdomain
- Login redirect stays on tenant subdomain after SSO
…ername column

The migration was trying to select from the users table using a username column
that doesn't exist in the current schema. Fixed by using display_name directly.
@wisdomqin
Copy link
Copy Markdown
Contributor

Thanks for this contribution. This PR covers several independent ideas, some of which are genuinely useful — particularly the ability to customize a company's slug for cleaner SSO subdomains.

Rather than asking you to split and resubmit, we'd like to collect your requirements and plan the right solutions into a future release. Could you walk us through:

For custom slug / SSO subdomain support:

  • What's the end-to-end flow you need? (e.g., admin sets slug → user visits slug.yourdomain.com → SSO login)
  • Is your domain setup multi-tenant (each company gets its own subdomain)?

For the Feishu org sync change:

We'll look at all of these holistically across #293, #294, and #295 and plan them together. Closing for now.

@bigbearcool
Copy link
Copy Markdown
Author

Hi wisdomqin, thanks for the feedback!

  1. End-to-end flow: Yes, exactly as you described:
    Admin sets a custom slug (e.g., "mycompany") in company settings
    User visits mycompany.clawith.com → auto-trigger SSO login with that company's configured IdP (Feishu/Feishu Enterprise)
    No need to select company manually, seamless single-sign-on
  2. Multi-tenant: Yes, each company/tenant has its own subdomain. Our use case is serving multiple enterprise customers on one Clawith instance, each with their own SSO configuration.
    Hope this helps clarify the requirements!

@bigbearcool bigbearcool closed this Apr 6, 2026
@bigbearcool bigbearcool deleted the sso-enterprise-support branch April 6, 2026 04:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants