pgkiln 0.61.0 → 0.63.0

package/SECURITY.md

@@ -114,6 +114,8 @@ first version (MVP). Every finding below has a regression test in
 | Builder texts in the browser (sprint 123) | The builder's JavaScript gets its texts as JSON in an attribute (`<div id="builder-texts" data-texts>`), escaped like any attribute value, so builder pages still have no inline script. The texts are the fixed message files, never data; scripts put them into the page with `textContent` and attributes, not as HTML. |
 | Two-factor sign-in for developers (0.60.0) | TOTP secrets (RFC 6238, 160 bits) are encrypted with `PGKILN_SECRET_KEY` and stored only after a code from the app confirms them; recovery codes (10 × 50 bits) are stored as SHA-256 and used up atomically; a code is accepted once (the last step is updated atomically) and only one 30-second step either side. The password step leaves only a pending sign-in in the session (5 minutes, no session for the developer yet); wrong codes count with wrong passwords for the per-user and per-IP lockout. Removing an app needs the password; another developer's factors can only be reset by an administrator, with a reason, which ends that developer's builder sessions. The require policy can only be turned on, and stays enforceable, with at least two administrators (or every one) holding an app; there is no setting, URL or variable that skips the second step: recovery is `pgkiln admin reset-2fa` / `set-2fa-policy off` on the server with the owner connection. Every enrolment, removal, reset, policy change and used recovery code is in the activity log; resets and policy changes are mailed to the administrators. The factor tables are closed to the runtime role. |
 | Passkeys and trusted browsers (0.61.0) | Passkeys (WebAuthn) are checked in `src/webauthn.ts` without a library: a 32-byte one-time challenge per purpose (registration or sign-in) kept in the session for five minutes and used up on the first answer, the `clientDataJSON` type, challenge and origin (`PUBLIC_URL`'s, else the browser's own), the SHA-256 of the relying party id in the authenticator data, user presence, an ES256, EdDSA or RS256 signature over the authenticator data and the client data hash, and a signature counter that must go up (updated atomically, so a replayed or cloned key is refused). The CBOR reader takes only definite lengths, at most 16 levels and 1,000 entries. Credentials are public keys (no secret to leak, independent of the instance key); attestation is *none*. `PGKILN_RP_ID` is only honoured when it is the host or a parent domain of it. The sign-in options (the developer's credential ids) are only given after the password step, with the CSRF token. Trusted browsers (off by default) are a random 256-bit cookie token (`HttpOnly`, `SameSite=Lax`, `Secure` with `COOKIE_SECURE`, path `/builder`) of which only the SHA-256 is stored; the cookie is only looked at after a correct password, for that developer, and ends with its days, a new password, removing a factor, a reset, *Forget trusted browsers* or turning trust off (which removes every trusted browser at once). |
+| Passkey sign-in without a password, workspace rule (0.62.0) | *Sign in with a passkey* asks the browser for any passkey of this site (empty allow list) with `userVerification: required`, and the server refuses an answer whose authenticator data lacks the user-verified flag, so the passkey alone stands for possession plus a fingerprint, face or PIN. The credential id is looked up for this relying party only; a user handle, when the browser sends one, must be the developer's (a SHA-256-derived handle, not the user name). The same one-time challenge, origin, RP ID hash, signature and counter checks as at the second step apply; failures are logged as `login_failed` with the developer's name when the key is known and count for the per-user and per-IP lockout. Administrators turn it off in Instance settings. A workspace's rule (administrators and its own administrators only, CSRF-checked) can only add a requirement; `pgkiln admin set-2fa-policy off` clears every workspace's rule. While a second factor is required of a developer, a sign-in with the default password leads only to the password change. |
+| Single sign-on for developers (0.63.0) | A provider or directory signs developers in only with *builder* turned on. The flow is the applications' (state, PKCE, nonce, browser-binding cookie, ID token or SAML assertion checks) with a pending row without an application; developers are found by the provider's stable subject in `meta.developer_identity`, never by a name alone. An existing developer is linked by name only when the administrator allows it, once, never a break-glass administrator, and an e-mail user name only when verified; otherwise the developer links the identity on Security, which needs their session and CSRF token to start and the same browser to finish, and one identity can't be linked to two developers. Automatic accounts need the developers group when one is set and start as developers; the administrators group decides the role at every sign-in but never demotes a break-glass administrator. A workspace's single sign-on rule (administrators and its own administrators, CSRF-checked) refuses the pgkiln password and a passkey alone, after the password check so it reveals nothing; it can only be turned on while a break-glass administrator exists and by someone who could still sign in; the last break-glass administrator and a developer's last identity can't be removed while it applies. Failures are logged as `login_failed` with the reason. |
 
 ## Findings of the MVP review and their fixes
 
@@ -236,4 +238,5 @@ A second full review, mainly of what end users and API callers can reach. Regres
 8. With REST data sources: list only the hosts you need in `PGKILN_REST_ALLOWED_HOSTS` (avoid `*`), set a long random `PGKILN_SECRET_KEY` (32+ characters) kept outside the database and its backups, and use `PGKILN_REST_PRIVATE_HOSTS` only for internal services you mean to reach. Narrow it further per workspace under Administration → Network access (sprint 118).
 9. With header authentication: list only your proxy's addresses in `PGKILN_AUTH_HEADER_PROXIES`, make sure users can't reach pgkiln directly, and have the proxy remove any incoming copy of the header.
 10. With database-account authentication: list exact roles or use a dedicated membership role, and limit what those roles may connect to in `pg_hba.conf` (they can reach the database with their password outside pgkiln too).
-11. Turn on two-factor sign-in for the builder (Instance settings → Two-factor sign-in, at least for administrators) once two administrators have a passkey or an authenticator app; set `PUBLIC_URL` to the address developers use (passkeys belong to its host name), keep *Trust a browser* short or at 0 on shared machines, keep `PGKILN_SECRET_KEY` backed up, and keep the recovery commands (`pgkiln admin reset-2fa`) for people with server access only.
+11. Turn on two-factor sign-in for the builder (Instance settings → Two-factor sign-in, at least for administrators) once two administrators have a passkey or an authenticator app; set `PUBLIC_URL` to the address developers use (passkeys belong to its host name), require it per workspace where the instance policy is too broad, keep *Trust a browser* short or at 0 on shared machines, keep `PGKILN_SECRET_KEY` backed up, and keep the recovery commands (`pgkiln admin reset-2fa`) for people with server access only.
+12. With single sign-on for developers: leave *Link an existing developer with the same user name* off unless you trust the provider's user names, set a developers group for automatic accounts, make at least one administrator break-glass (with a second factor and a password kept safe) before a workspace requires single sign-on, and keep `pgkiln admin builder-sign-in password` for people with server access only.

package/db/migrations/130_passkey_signin_workspace_mfa.sql

@@ -0,0 +1,20 @@
+-- ---------------------------------------------------------------------
+-- 130: passkey sign-in and a workspace two-factor rule (sprint 128,
+-- SEC-2 part 3; beyond APEX).
+--
+-- meta.workspace.mfa_required_since: when set, every developer of the
+-- workspace needs a second factor, with the instance's grace period
+-- (mfa_grace_days) counted from this moment; null = the instance policy
+-- alone decides. Administrators of the instance are covered only where they
+-- are members. `pgkiln admin set-2fa-policy off` clears it everywhere.
+--
+-- meta.setting mfa_passkey_signin ('on', the default, or 'off'): a
+-- developer may sign in with a passkey alone, without the password, when
+-- the authenticator verified them (fingerprint, face, PIN). It counts as
+-- both factors.
+-- ---------------------------------------------------------------------
+alter table meta.workspace add column mfa_required_since timestamptz;
+
+comment on column meta.workspace.mfa_required_since is 'Two-factor sign-in required for this workspace''s developers since (null = not by the workspace) (130).';
+
+insert into meta.setting (name, value) values ('mfa_passkey_signin', 'on') on conflict (name) do nothing;

package/db/migrations/131_builder_sso.sql

@@ -0,0 +1,69 @@
+-- ---------------------------------------------------------------------
+-- 131: signing in to the builder through an identity provider, with a
+-- break-glass administrator (sprint 129, SEC-1; APEX: the workspace's
+-- authentication scheme).
+--
+-- meta.auth_provider / meta.ldap_directory.builder: the provider (OpenID
+-- Connect, SAML) or directory also signs developers in to the builder.
+--   builder_auto_create: a person without a developer account gets one on
+--     the first sign-in, when builder_group is empty or one of their groups;
+--   builder_link_existing: a developer with the same username is linked on
+--     the first sign-in (never a break-glass developer); otherwise developers
+--     link the identity themselves on the Security page;
+--   builder_admin_group: members are instance administrators (checked on
+--     every sign-in; break-glass developers are never demoted).
+-- meta.developer_identity: the identities linked to a developer, by the
+-- provider's or directory's stable subject (as meta.account_identity and
+-- meta.ldap_identity for application accounts).
+-- meta.developer.break_glass: may still sign in with the pgkiln password
+-- (and passkey) where a workspace requires single sign-on; for when the
+-- identity provider is down or misconfigured.
+-- meta.workspace.sso_only: the workspace's developers must sign in through
+-- an identity provider or directory (break-glass developers excepted).
+-- `pgkiln admin builder-sign-in password` clears it everywhere.
+-- meta.sso_pending.app_id null: a sign-in to the builder; link_username: the
+-- signed-in developer who links an identity from the Security page.
+-- ---------------------------------------------------------------------
+alter table meta.auth_provider
+  add column builder boolean not null default false,
+  add column builder_auto_create boolean not null default false,
+  add column builder_link_existing boolean not null default false,
+  add column builder_group text check (length(builder_group) between 1 and 200),
+  add column builder_admin_group text check (length(builder_admin_group) between 1 and 200);
+
+alter table meta.ldap_directory
+  add column builder boolean not null default false,
+  add column builder_auto_create boolean not null default false,
+  add column builder_link_existing boolean not null default false,
+  add column builder_group text check (length(builder_group) between 1 and 200),
+  add column builder_admin_group text check (length(builder_admin_group) between 1 and 200);
+
+comment on column meta.auth_provider.builder is 'Developers can sign in to the builder with this provider (131).';
+comment on column meta.ldap_directory.builder is 'Developers can sign in to the builder with this directory (131).';
+
+create table meta.developer_identity (
+  id           serial primary key,
+  provider_id  integer references meta.auth_provider (id) on delete cascade,
+  directory_id integer references meta.ldap_directory (id) on delete cascade,
+  subject      text not null check (length(subject) between 1 and 500),
+  username     text not null references meta.developer (username) on update cascade on delete cascade,
+  linked_at    timestamptz not null default now(),
+  check ((provider_id is null) <> (directory_id is null))
+);
+create unique index developer_identity_provider_subject on meta.developer_identity (provider_id, subject) where provider_id is not null;
+create unique index developer_identity_directory_subject on meta.developer_identity (directory_id, subject) where directory_id is not null;
+create unique index developer_identity_provider_user on meta.developer_identity (provider_id, username) where provider_id is not null;
+create unique index developer_identity_directory_user on meta.developer_identity (directory_id, username) where directory_id is not null;
+create index developer_identity_username on meta.developer_identity (username);
+
+comment on table meta.developer_identity is 'Identities at providers or directories linked to a developer, by stable subject (131).';
+
+alter table meta.developer add column break_glass boolean not null default false;
+comment on column meta.developer.break_glass is 'May sign in with the pgkiln password where a workspace requires single sign-on (131).';
+
+alter table meta.workspace add column sso_only boolean not null default false;
+comment on column meta.workspace.sso_only is 'Developers of this workspace must sign in through an identity provider or directory (131).';
+
+alter table meta.sso_pending alter column app_id drop not null;
+alter table meta.sso_pending add column link_username text references meta.developer (username) on update cascade on delete cascade;
+comment on column meta.sso_pending.app_id is 'The application signed in to; null: the builder (131).';

package/docs/apex-feature-parity.md

@@ -138,7 +138,7 @@ the 26.2 comparison.)
 | APEX accounts | ✅ | Instance-wide user directory, bcrypt, session rotation, idle and absolute timeouts |
 | Application Access Control (roles per app, any-user switch) | ✅ | Access control per application |
 | Social sign-in / OpenID Connect | ✅ | Any OIDC provider (Entra ID, Google, Okta, Keycloak, …): PKCE, group → role mapping, account linking, automatic accounts |
-| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprints 126–127): the builder itself has two-factor sign-in with passkeys (WebAuthn), authenticator apps (TOTP) and recovery codes, trusted browsers, a policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)); two-factor for application users follows (SEC-3) |
+| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprints 126–128): the builder itself has two-factor sign-in with passkeys (WebAuthn, also on their own without a password), authenticator apps (TOTP) and recovery codes, trusted browsers, an instance and per-workspace policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)); two-factor for application users follows (SEC-3) |
 | Change own password | ✅ | A built-in *My account* page (APEX offers the API `CHANGE_CURRENT_USER_PW`) |
 | Password expiry, change on first use, admin reset, complexity | ✅ | Lifetime in days, expire/unexpire, admin reset, length and letters+digits rules, unlock |
 | Lockout after failed sign-ins | ✅ | Per user and per IP, time-based (APEX: until an administrator unlocks) |
@@ -221,7 +221,7 @@ the 26.2 comparison.)
 
 | APEX | pgkiln | Notes |
 |---|---|---|
-| Developer accounts, workspace sign-in | ✅ | (sprint 61) The builder's sign-in page like APEX's: workspace (optional; it becomes the current one, a wrong one answers like a wrong password), username, password with a Show button, *Remember workspace and username*, a link to Administration. (sprint 68) **Find my workspace**: developers' e-mail addresses, and a mail with their workspaces through the builder's mail service (the same answer for every address, limited per address and IP). (sprint 121) The sign-in page's language links: Deutsch, English, Español, Français, Nederlands, Português (WS-7) |
+| Developer accounts, workspace sign-in | ✅ | (sprint 61) The builder's sign-in page like APEX's: workspace (optional; it becomes the current one, a wrong one answers like a wrong password), username, password with a Show button, *Remember workspace and username*, a link to Administration. (sprint 68) **Find my workspace**: developers' e-mail addresses, and a mail with their workspaces through the builder's mail service (the same answer for every address, limited per address and IP). (sprint 121) The sign-in page's language links: Deutsch, English, Español, Français, Nederlands, Português (WS-7). (sprint 129, SEC-1) **Single sign-on for developers** (APEX: the workspace's authentication scheme): the applications' OpenID Connect and SAML providers and LDAP directories can sign developers in to the builder, linked by the provider's stable subject (or by the developer on Security), created from a developers group, with an administrators group; a workspace can require it of its developers, with break-glass administrators who keep the password and `pgkiln admin builder-sign-in password` ([chapter 3](guide/03-builder.md#single-sign-on-for-developers)) |
 | Workspace home (tool cards, top apps and users, summary, workspace and system message) | ✅ | (sprint 109) `/builder/home` opens after sign-in ([chapter 3](guide/03-builder.md#workspace-home)): App Builder, SQL Workshop, Data Reporter and App Gallery cards; the workspace message edited in place; a Summary of applications, tables, developers and reporting applications; top applications, users and developers over an hour, a day or a week; a system message with the server's version and, with the optional release check (`PGKILN_RELEASE_CHECK`, off by default), *pgkiln X is available*. The App Builder moved to `/builder/apps`; `/builder` opens either, per workspace. |
 | Workspace message, environment banner, workspace utilization, preferences and extension links (Manage Service) | ✅ | (sprint 61) An **Administration** menu in the icon rail; administrators and workspace administrators set a **workspace message** (on the App Builder home) and an **environment banner** (a coloured label on every builder page of the workspace), and see **workspace utilization** (applications, pages, page views, users, static files, schema storage) ([chapter 3](guide/03-builder.md#workspace-message-and-environment-banner)). (sprint 62) **Workspace preferences**: the SQL Workshop and the applications' RESTful services (REST modules) on or off per workspace; **extension links** in an Extensions menu of the rail ([chapter 3](guide/03-builder.md#workspace-preferences)). **Missing:** the account login controls of APEX's preferences (pgkiln's password policy and sign-in throttling are installation-wide) |
 | Instance administration, install/upgrade logs (26.1) | ✅ | Versioned migrations (`npm run db:migrate`), every run logged; Workspace utilities → **Installation** (administrators): server version, install and upgrade runs with errors, applied migrations, and warnings for migrations the database misses or the server doesn't know ([chapter 3](guide/03-builder.md)). Workspace utilities → **Instance settings**: session length and sign-in throttling (stored in the database, over the environment variables) and an overview of the server's configuration without secrets; a server whose database lacks migrations says so (503) or applies them (`MIGRATE_ON_START`). Other settings stay environment variables |
@@ -296,8 +296,9 @@ Small but real differences, for teams comparing the two:
 - Responsive layouts verified automatically at four screen sizes.
 - The theme follows the device's light/dark setting automatically, and the choice is saved per user.
 - A built-in *My account* page (own password, theme, language).
-- (sprints 126–127) **Two-factor sign-in for the builder** without an identity provider: passkeys (WebAuthn), authenticator apps (TOTP),
-  recovery codes, a policy for administrators or all developers with a grace period, and lockout recovery on the
+- (sprints 126–128) **Two-factor sign-in for the builder** without an identity provider: passkeys (WebAuthn; sign-in with a
+  passkey alone), authenticator apps (TOTP), recovery codes, a policy for administrators, all developers or a
+  workspace's developers with a grace period, and lockout recovery on the
   command line ([chapter 3](guide/03-builder.md#two-factor-sign-in)). APEX relies on the identity provider.
 - One RLS policy set protects both the web UI and the REST API.
 - An import can be checked before it commits (`pgkiln import --check`): SQL that names a missing

package/docs/guide/03-builder.md

@@ -68,6 +68,13 @@ one passkey on several sub-domains, set `PGKILN_RP_ID` to the parent domain (`ex
 instance key changes. pgkiln accepts any authenticator (attestation *none*), checks the signature, the address and
 the relying party on every sign-in, and refuses a key whose signature counter goes back (a copied key).
 
+**A passkey alone** (0.62): the sign-in page has **Sign in with a passkey** next to the password form. The browser
+offers the passkeys it holds for this site, and you choose one; no user name, no password. It only works when the
+device verified you (fingerprint, face or PIN), so the passkey counts as both factors; a workspace typed in the form
+still applies. Administrators can turn it off in Instance settings → *Two-factor sign-in* (*Developers may sign in
+with a passkey alone*, on by default). A security key without a PIN, or a passkey made before 0.61 that the browser
+doesn't offer, still works at the second step after the password.
+
 The app's secret is stored encrypted with the instance key (`PGKILN_SECRET_KEY`, [chapter 1](01-installation.md));
 without the key the page says so and you can't add an app. Recovery codes are stored as SHA-256 hashes, so they keep
 working if the key is lost. Wrong codes count with wrong passwords for the [sign-in lockout](08-security.md#what-sign-in-protects-against).
@@ -77,6 +84,15 @@ sign-in*: **Nobody** (optional, the default), **Administrators** or **All develo
 (default 7 days). During the grace period a developer without an app sees a reminder on every page; after it, they
 see only their Security page until they add one. The region lists the developers who have no app yet.
 
+**Per workspace** (0.62): a workspace's page (Workspace utilities → Workspaces → the workspace, *Preferences*) has
+*Require two-factor sign-in of this workspace's developers*, for administrators and the workspace's own
+administrators. It adds to the instance's policy: the workspace's developers get the instance's grace period from the
+moment it was turned on, then only their Security page. The page lists the members who have no factor yet.
+
+**The default password** (0.62): a developer who signs in with the default password (`admin`, or their user name)
+while two-factor sign-in is required of them sees only **Developers**, to change it, before anything else (then the
+grace period or the Security page as above).
+
 **Trusted browsers** (0.61): *Trust a browser (days)* in the same region (0, the default: never) adds *Trust this
 browser for N days* to the second step. A trusted browser skips the second step for that developer until the days
 are over; only a hash of the cookie's random token is stored. The developer's Security page shows how many browsers
@@ -95,6 +111,51 @@ setting the days to 0 stops every trusted browser at once.
   `2fa_enrolled`, `2fa_recovery_used`), and resets and policy changes are mailed to the administrators when the
   builder has a mail service (*Builder mail*).
 
+### Single sign-on for developers
+
+(0.63) Developers can sign in to the builder through the organisation's **identity provider** (OpenID Connect or SAML
+2.0) or an **LDAP directory**, the ones applications use (Workspace utilities → Users → *Identity providers*,
+*LDAP directories*; [chapter 8](08-security.md)). APEX does this with the workspace's authentication scheme.
+
+**Turning it on.** On the provider's or directory's page, administrators fill in **Builder sign-in**:
+
+- *Developers can sign in to the builder with it*: the sign-in page shows **Sign in with Company IdP** under the
+  password form. A directory adds a **Sign in with** choice above the user name (*pgkiln account* or the directory),
+  and the password goes to the directory. The provider's redirect URI (or SAML ACS URL) is the one registered for
+  applications already.
+- *Create developers on their first sign-in*, for members of the **Developers group** (anyone, when it is empty).
+  They start as developers in the Default workspace, with the provider's e-mail address and a password nobody knows.
+- **Administrators group**: when set, its members are instance administrators and nobody else is, checked at every
+  sign-in (break-glass administrators, below, are never demoted).
+- *Link an existing developer with the same user name*: once, at the first sign-in, never a break-glass
+  administrator, and an e-mail address as user name only when the provider says it is verified. Leave it off unless
+  you trust the provider's user names; developers can link themselves instead.
+
+**Linking.** A developer is found by the provider's stable subject (`sub`, the SAML NameID, the entry's `entryUUID`),
+never by a name the provider sends. A developer who signs in with the password links an identity on **Security** →
+*Single sign-on* → **Link Company IdP**: the provider's page opens and the identity is linked to the developer who
+started it (in the same browser). The region lists linked identities, with **Unlink**. A provider's page lists the
+developers linked to it; administrators unlink any of them.
+
+Signing in through a provider skips pgkiln's own second step and the enrolment on Security: the provider decides on
+the second factor. A directory checks a password, so pgkiln's second step follows as with the pgkiln password.
+
+**Requiring it per workspace.** A workspace's page (*Preferences* → *Single sign-on*) has *This workspace's
+developers must sign in through an identity provider* (or a directory). Its developers' pgkiln password and a passkey
+alone are refused from then on; the page lists members without a linked identity, who can't sign in until they link
+one. It can be turned on only while there is a **break-glass administrator**, and only by someone who has a linked
+identity or is break-glass, so nobody locks themselves out.
+
+**Break-glass administrators.** On **Developers**, an administrator makes another administrator *break-glass*: they
+may still sign in with the pgkiln password where a workspace requires single sign-on, for when the identity provider
+is down or misconfigured. Give them a second factor and a long password, and keep the password somewhere safe. The
+last break-glass administrator can't lose it while a workspace requires single sign-on, nor be made a developer or
+removed. If nobody can sign in at all: `pgkiln admin builder-sign-in password` on the server turns the workspaces'
+rule off ([chapter 18](18-cli.md)).
+
+Sign-ins are in the activity log as `login` with *builder sso:company* or *builder ldap:corp*; failures as
+`login_failed` with the reason; linking, unlinking and settings as `sso_linked`, `sso_unlinked` and `sso_policy`.
+
 ### Locked out?
 
 | Situation | What to do |
@@ -103,7 +164,8 @@ setting the days to 0 stops every trusted browser at once.
 | Lost phone, keys and codes | Ask another administrator to reset your two-factor sign-in on Developers |
 | A passkey no longer works after a move to another domain | Sign in with an app code or a recovery code and add a new passkey ([above](#two-factor-sign-in)) |
 | No administrator can sign in | On the server: `pgkiln admin reset-2fa <developer> --reason "…"` ([chapter 18](18-cli.md)), then sign in with the password |
-| The policy locks everyone out | On the server: `pgkiln admin set-2fa-policy off` |
+| The policy locks everyone out | On the server: `pgkiln admin set-2fa-policy off` (also clears the workspaces' own rules) |
+| The identity provider is down and a workspace requires single sign-on | A break-glass administrator signs in with the password and turns the workspace's rule off; without one, on the server: `pgkiln admin builder-sign-in password` |
 | Codes are always wrong | Check the time on the phone and on the server (codes allow 30 seconds either way) |
 | The instance key was lost or changed | The apps' secrets can't be read: reset the developers (`pgkiln admin reset-2fa`); recovery codes still work |
 

package/docs/guide/08-security.md

@@ -148,7 +148,8 @@ select id, 'alice', meta.hash_password('a-strong-password'), '{manager}' from me
 ### Single sign-on (OpenID Connect)
 
 Applications can let people sign in with your organisation's identity provider: Microsoft Entra
-ID, Google Workspace, Okta, Keycloak, Auth0 or any other OpenID Connect provider.
+ID, Google Workspace, Okta, Keycloak, Auth0 or any other OpenID Connect provider. (0.63) The same providers, SAML
+ones and LDAP directories can sign developers in to the builder too ([chapter 3](03-builder.md#single-sign-on-for-developers)).
 
 **1. Register pgkiln at the provider** as a *web application* (confidential client) using the
 authorization code flow. The redirect URI is `<PUBLIC_URL>/sso/callback/<name>`, for example

package/docs/guide/12-development.md

@@ -56,6 +56,8 @@ src/
   sso.ts                   OpenID Connect: discovery, sign-in flow, ID token checks, account linking
   saml.ts                  SAML 2.0 sign-in (node-saml): AuthnRequest, response checks, SP metadata
   ldap.ts                  LDAP directories: search + bind, groups, account linking (ldapts)
+  devsso.ts                (sprint 129) developers through identity providers and directories: resolveDeveloper (subject, link, create,
+                           administrators group), linkDeveloper, ssoRequired (a workspace's rule, break-glass), clearSsoOnly
   headerauth.ts            HTTP-header authentication: trusted proxies (PGKILN_AUTH_HEADER_PROXIES), header checks, accounts
   dbauth.ts                database-account authentication: role lists, a short connection as the role (DATABASE_URL target), membership/superuser checks
   customauth.ts            custom authentication: the app's function or PL/pgSQL body (a pg_temp function) and post-authentication code, as the app's role
@@ -343,6 +345,7 @@ src/
     quicksql.ts            SQL Workshop → Quick SQL page (preview, save as script, run)
     querybuilder.ts        SQL Workshop → Query Builder: catalog, joins by foreign key or drawn, functions/group by, buildQuery() from the URL; the canvas is in builder.js
     users.ts               user directory and identity providers
+    builder-sso.ts         (sprint 129) a provider's or directory's Builder sign-in region, Security's identities, unlink, break-glass
     datapump.ts            (sprint 103, DA-16) SQL Workshop → Schema Export / Import (/builder/sql/data-pump, administrators only):
                            jobs, export form, upload (streamed to PGKILN_DUMP_DIR), archive preview and import options, job log, download
     db-users.ts            (sprint 99, DA-13) Administration → Database Users (/builder/db-users, administrators only): PostgreSQL

package/docs/guide/18-cli.md

@@ -53,7 +53,8 @@ any (see [what is not exported](03-builder.md#export-format)).
 | `pgkiln users add <username> [--developer] [--app <alias> --roles a,b] [--name …] [--email …]` | Adds an account (optionally with access to an application) or a builder developer |
 | `pgkiln users password <username> [--developer]` | Sets a password and ends that user's sessions |
 | `pgkiln admin reset-2fa <developer> [--reason <text>]` | (0.60) Removes a developer's authenticator apps and recovery codes and ends their builder sessions: [locked out?](03-builder.md#locked-out) |
-| `pgkiln admin set-2fa-policy off\|admins\|all [--grace <days>]` | (0.60) Sets the builder's [two-factor policy](03-builder.md#two-factor-sign-in); `off` always works, the others need two administrators with an app |
+| `pgkiln admin set-2fa-policy off\|admins\|all [--grace <days>]` | (0.60) Sets the builder's [two-factor policy](03-builder.md#two-factor-sign-in); `off` always works (and, 0.62, clears every workspace's own rule), the others need two administrators with an app |
+| `pgkiln admin builder-sign-in password` | (0.63) Turns off every workspace's [single sign-on rule](03-builder.md#single-sign-on-for-developers), so developers may sign in with the pgkiln password again; logged and mailed to the administrators |
 
 `users` reads the password from standard input (the first line, e.g. from a secret store:
 `printf '%s\n' "$PW" | pgkiln users add ops --developer`) or asks for it twice on a terminal. It is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",

package/public/builder.css

@@ -675,6 +675,11 @@ kbd { display: inline-block; padding: 0 0.35em; border: 1px solid var(--border);
 .signin-reveal { flex: none; border: 0; background: none; color: var(--accent); cursor: pointer; font-size: 0.85rem; padding: 0.25rem; }
 .signin-remember { font-size: 0.9rem; }
 .signin-submit { padding: 0.75rem; font-size: 1rem; border-radius: var(--radius); }
+[data-passkey-status]:empty { display: none; }
+/* (sprint 129) linked identities, builder sign-in */
+.plain-list { list-style: none; padding: 0; margin: .25rem 0 .75rem; }
+.plain-list li { padding: .2rem 0; }
+.signin-idp { display: flex; align-items: center; justify-content: center; gap: .5rem; text-decoration: none; }
 .signin-hint { margin: 0; text-align: center; }
 .signin-actions { display: flex; flex-wrap: wrap; justify-content: center; gap: 0.5rem 1.5rem; margin-top: 1rem; padding-top: 1rem; border-top: 1px solid var(--border); }
 .signin-actions a { display: inline-flex; align-items: center; gap: 0.4rem; color: var(--gold); text-decoration: none; }

package/public/builder.js

@@ -1337,6 +1337,7 @@ document.querySelectorAll('input[data-filter-tree]').forEach((el) => {
 // (sprint 127) Passkeys: a [data-passkey] button asks the server (its URL) for WebAuthn options, calls
 // navigator.credentials.create() (Security page) or .get() (the second sign-in step) and posts the answer in
 // its own form, to data-passkey-submit when set, so the server answers with a redirect as for any form.
+// (sprint 128) On the sign-in page the list of allowed passkeys is empty: the browser offers the ones it holds.
 // Without WebAuthn or JavaScript the buttons stay hidden; codes keep working.
 (() => {
   'use strict';
@@ -1377,13 +1378,14 @@ document.querySelectorAll('input[data-filter-tree]').forEach((el) => {
           set('transports', (c.response.getTransports ? c.response.getTransports() : []).join(','));
         } else {
           const c = await navigator.credentials.get({ publicKey: {
-            challenge: bytes(o.challenge), rpId: o.rpId, userVerification: 'preferred', timeout: 120000,
+            challenge: bytes(o.challenge), rpId: o.rpId, userVerification: o.uv || 'preferred', timeout: 120000,
             allowCredentials: o.allow.map((a) => ({ type: 'public-key', id: bytes(a.id), transports: a.transports })),
           } });
           set('credentialId', b64(c.rawId));
           set('clientDataJSON', b64(c.response.clientDataJSON));
           set('authenticatorData', b64(c.response.authenticatorData));
           set('signature', b64(c.response.signature));
+          if (c.response.userHandle) set('userHandle', b64(c.response.userHandle));
         }
         if (btn.dataset.passkeySubmit) form.action = btn.dataset.passkeySubmit;
         form.submit();

package/src/builder/builder-sso.ts

@@ -0,0 +1,135 @@
+import type { FastifyInstance } from 'fastify';
+import { owner } from '../db.ts';
+import { html, raw, type Raw } from '../html.ts';
+import { icon } from '../icons.ts';
+import { clientIp, logActivity, type Session } from '../session.ts';
+import { breakGlassAdmins, builderSources, identitiesOf, ssoRequired } from '../devsso.ts';
+import { isAdmin } from './locks.ts';
+import { tr } from './i18n.ts';
+import { administrator, back, BASE, csrf, developer, flash, input, region, type Req } from './ui.ts';
+
+// (sprint 129, SEC-1) Builder sign-in through identity providers and LDAP directories (devsso.ts):
+//  * Users → Identity providers / LDAP directories → "Builder sign-in": on or off, creating developers,
+//    linking existing ones, the groups; the developers linked there;
+//  * Security: the developer's own identities, "Link" for each provider, "Unlink";
+//  * Developers: break-glass administrators (they may use the pgkiln password where a workspace
+//    requires single sign-on).
+
+type Kind = 'provider' | 'directory';
+const TABLE = { provider: 'meta.auth_provider', directory: 'meta.ldap_directory' } as const;
+const COLUMN = { provider: 'provider_id', directory: 'directory_id' } as const;
+const PATH = { provider: 'providers', directory: 'directories' } as const;
+
+const check = (name: string, label: string, on: boolean, help?: string) =>
+  html`<div class="field"><label class="check"><input type="checkbox" name="${name}" value="true"${on ? raw(' checked') : ''}> ${label}</label>${help ? html`<small class="help">${help}</small>` : ''}</div>`;
+
+/** The "Builder sign-in" region of a provider's or directory's page. */
+export async function builderSignInRegion(s: Session, kind: Kind, row: { id: number; builder: boolean; builder_auto_create: boolean; builder_link_existing: boolean; builder_group: string | null; builder_admin_group: string | null }): Promise<Raw> {
+  const tx = tr(s);
+  const linked = (await owner.query<{ id: number; username: string; linked_at: string }>(
+    `select id, username, linked_at from meta.developer_identity where ${COLUMN[kind]} = $1 order by username`, [row.id])).rows;
+  return region(tx('bsso.title'), html`<p class="muted u-mt0">${tx('bsso.intro')}</p>
+    <form method="post" action="${BASE}/users/${PATH[kind]}/${row.id}/builder">${csrf(s)}
+      ${check('builder', tx('bsso.on'), row.builder, tx('bsso.on_help'))}
+      ${check('builder_auto_create', tx('bsso.auto_create'), row.builder_auto_create, tx('bsso.auto_create_help'))}
+      ${check('builder_link_existing', tx('bsso.link_existing'), row.builder_link_existing, tx('bsso.link_existing_help'))}
+      <div class="form-grid">
+        ${input('builder_group', tx('bsso.group'), row.builder_group ?? '', { help: tx('bsso.group_help') })}
+        ${input('builder_admin_group', tx('bsso.admin_group'), row.builder_admin_group ?? '', { help: tx('bsso.admin_group_help') })}
+      </div>
+      <div class="buttons"><button class="btn">${tx('bsso.save')}</button></div></form>
+    <h3>${tx('bsso.linked')}</h3>
+    ${linked.length
+      ? html`<ul class="plain-list">${linked.map((l) => html`<li>${icon('user')} ${l.username} <span class="muted small">${String(l.linked_at).slice(0, 10)}</span>
+          <form method="post" action="${BASE}/developers/identity/${l.id}/unlink" class="u-inline">${csrf(s)}<button class="link-button" data-confirm="${tx('bsso.unlink_confirm', { user: l.username })}">${tx('bsso.unlink')}</button></form></li>`)}</ul>`
+      : html`<p class="muted">${tx('bsso.none_linked')}</p>`}`, '', 'builder-sign-in');
+}
+
+/** The Security page's region: the developer's identities, and the providers to link. */
+export async function identitiesRegion(s: Session, linkedNow: string | undefined): Promise<Raw | ''> {
+  const tx = tr(s);
+  const [mine, sources] = await Promise.all([identitiesOf(s.username!), builderSources()]);
+  if (!mine.length && !sources.providers.length && !sources.directories.length) return '';
+  const linkable = sources.providers.filter((p) => !mine.some((m) => m.kind === 'provider' && m.source === p.name));
+  const linked = linkedNow ? mine.find((m) => m.kind === 'provider' && m.source === linkedNow) : undefined;
+  return region(tx('bsso.yours'), html`<p class="muted u-mt0">${tx('bsso.yours_intro')}</p>
+    ${linked ? html`<div class="alert alert-success" role="status">${tx('bsso.linked_now', { provider: linked.display_name })}</div>` : ''}
+    ${mine.length
+      ? html`<ul class="plain-list">${mine.map((m) => html`<li>${icon(m.kind === 'provider' ? 'log-in' : 'server')} ${m.display_name} <span class="muted small">${String(m.linked_at).slice(0, 10)}</span>
+          <form method="post" action="${BASE}/developers/identity/${m.id}/unlink" class="u-inline">${csrf(s)}<button class="link-button" data-confirm="${tx('bsso.unlink_mine_confirm', { provider: m.display_name })}">${tx('bsso.unlink')}</button></form></li>`)}</ul>`
+      : html`<p class="muted">${tx('bsso.none_yours')}</p>`}
+    ${linkable.map((p) => html`<form method="post" action="${BASE}/security/link/${p.name}" class="u-inline">${csrf(s)}<button class="btn">${icon('link')} ${tx('bsso.link', { provider: p.display_name })}</button></form> `)}
+    ${sources.directories.length ? html`<p class="muted small">${tx('bsso.directories_note')}</p>` : ''}`, '', 'identities');
+}
+
+/** Would this change leave a workspace that requires single sign-on without a break-glass administrator? */
+export async function leavesNoBreakGlass(username: string) {
+  if (!(await owner.one('select 1 as ok from meta.workspace where sso_only limit 1'))) return false;
+  const left = (await breakGlassAdmins()).filter((u) => u !== username);
+  return left.length === 0;
+}
+
+export async function builderSsoRoutes(app: FastifyInstance) {
+  for (const kind of ['provider', 'directory'] as Kind[])
+    app.post(`${BASE}/users/${PATH[kind]}/:id(^\\d{1,9}$)/builder`, async (req: Req, reply) => {
+      const s = await administrator(req, reply, kind === 'provider' ? 'Identity providers' : 'LDAP directories');
+      if (!s) return;
+      const b = req.body ?? {};
+      const group = (v: unknown) => String(v ?? '').trim().slice(0, 200) || null;
+      const on = b.builder === 'true';
+      const r = await owner.one<{ name: string }>(
+        `update ${TABLE[kind]} set builder = $2, builder_auto_create = $3, builder_link_existing = $4, builder_group = $5, builder_admin_group = $6
+          where id = $1 returning name`,
+        [req.params.id, on, b.builder_auto_create === 'true', b.builder_link_existing === 'true', group(b.builder_group), group(b.builder_admin_group)],
+      );
+      if (!r) return reply.code(404).send('Not found');
+      await logActivity({ username: s.username, event: 'sso_policy', ip: clientIp(req), detail: `${kind} ${r.name}: builder sign-in ${on ? 'on' : 'off'}` });
+      flash(s, tr(s)('bsso.saved'));
+      return back(reply, s, `${BASE}/users/${PATH[kind]}/${req.params.id}#builder-sign-in`);
+    });
+
+  // unlinking: the developer's own identity, or any for an administrator
+  app.post(`${BASE}/developers/identity/:id(^\\d{1,9}$)/unlink`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const tx = tr(s);
+    const i = await owner.one<{ username: string; provider_id: number | null; directory_id: number | null }>('select username, provider_id, directory_id from meta.developer_identity where id = $1', [req.params.id]);
+    const admin = await isAdmin(s.username);
+    if (!i || (i.username !== s.username && !admin)) return reply.code(404).send('Not found');
+    const where = i.username === s.username ? `${BASE}/security#identities` : `${BASE}/users/${i.provider_id ? 'providers' : 'directories'}/${i.provider_id ?? i.directory_id}#builder-sign-in`;
+    // the last identity of a developer who must use single sign-on: they could not sign in any more
+    const only = await owner.one<{ n: number }>('select count(*)::int as n from meta.developer_identity where username = $1', [i.username]);
+    if (only!.n <= 1 && (await ssoRequired(i.username))) {
+      flash(s, tx('bsso.keep_one'), 'error');
+      return back(reply, s, where);
+    }
+    await owner.query('delete from meta.developer_identity where id = $1', [req.params.id]);
+    await logActivity({ username: s.username, event: 'sso_unlinked', ip: clientIp(req), detail: `${i.username}: ${i.provider_id ? `provider ${i.provider_id}` : `directory ${i.directory_id}`}` });
+    flash(s, tx('bsso.unlinked'));
+    return back(reply, s, where);
+  });
+
+  // break-glass: administrators only, for administrators
+  app.post(`${BASE}/developers/break-glass`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    if (!(await isAdmin(s.username))) return reply.code(403).send('Only administrators change break-glass access.');
+    const tx = tr(s);
+    const username = String(req.body?.username ?? '');
+    const on = req.body?.break_glass === 'true';
+    const d = await owner.one<{ is_admin: boolean }>('select is_admin from meta.developer where username = $1', [username]);
+    if (!d) return reply.code(404).send('Not found');
+    if (on && !d.is_admin) {
+      flash(s, tx('bsso.break_glass_admins'), 'error');
+      return back(reply, s, `${BASE}/developers`);
+    }
+    if (!on && (await leavesNoBreakGlass(username))) {
+      flash(s, tx('bsso.keep_break_glass'), 'error');
+      return back(reply, s, `${BASE}/developers`);
+    }
+    await owner.query('update meta.developer set break_glass = $2 where username = $1', [username, on]);
+    await logActivity({ username: s.username, event: 'sso_policy', ip: clientIp(req), detail: `${username}: break-glass ${on ? 'on' : 'off'}` });
+    flash(s, tx(on ? 'bsso.break_glass_on' : 'bsso.break_glass_off', { user: username }));
+    return back(reply, s, `${BASE}/developers`);
+  });
+}

package/src/builder/i18n/de.ts

@@ -1808,4 +1808,66 @@ export const de: BuilderMessages = {
   'mfa.trust_days': 'Browser vertrauen (Tage)',
   'mfa.trust_days_help': 'Nach dem zweiten Schritt darf ein Entwickler ihn in diesem Browser so viele Tage überspringen. 0: nie.',
   'mfa.passkey_needs_host': 'Passkeys brauchen einen Hostnamen, keine IP-Adresse ({host}): Öffnen Sie den Builder über localhost oder seinen Domainnamen.',
+  'signin.passkey': 'Mit einem Passkey anmelden',
+  'mfa.passkey_signin': 'Entwickler dürfen sich nur mit einem Passkey anmelden (ohne Passwort)',
+  'mfa.passkey_signin_help': 'Nur wenn das Gerät den Entwickler geprüft hat (Fingerabdruck, Gesicht oder PIN): Dann zählt der Passkey als beide Faktoren.',
+  'mfa.weak_required': 'Zwei-Faktor-Anmeldung ist erforderlich: Ändern Sie das Standardpasswort, bevor Sie fortfahren.',
+  'wsp.mfa': 'Zwei-Faktor-Anmeldung',
+  'wsp.mfa_required': 'Zwei-Faktor-Anmeldung für die Entwickler dieses Workspace verlangen',
+  'wsp.mfa_required_help': 'Zusätzlich zur Richtlinie der Instanz. Entwickler ohne Passkey oder Authenticator-App erhalten die Übergangsfrist der Instanz, danach nur ihre Sicherheitsseite.',
+  'wsp.mfa_since': 'Erforderlich seit {date}.',
+  'wsp.mfa_without': 'Noch nicht eingerichtet: {list}.',
+  'wsp.mfa_save': 'Zwei-Faktor-Regel speichern',
+  'wsp.mfa_on': 'Die Entwickler dieses Workspace brauchen die Zwei-Faktor-Anmeldung.',
+  'wsp.mfa_off': 'Der Workspace verlangt keine Zwei-Faktor-Anmeldung mehr (die Richtlinie der Instanz gilt weiter).',
+  'signin.method': 'Anmelden mit',
+  'signin.method_pgkiln': 'pgkiln-Konto',
+  'signin.with': 'Mit {provider} anmelden',
+  'signin.ldap_unavailable': '{directory} ist nicht erreichbar. Versuchen Sie es später erneut.',
+  'signin.sso_required': 'Ihr Workspace verlangt Single Sign-on: Melden Sie sich über Ihren Identitätsanbieter an.',
+  'signin.sso_unavailable': '{provider} ist nicht erreichbar. Versuchen Sie es später erneut.',
+  'bsso.title': 'Builder-Anmeldung',
+  'bsso.intro': 'Entwickler können sich auch mit diesem Anbieter im Builder anmelden. Sie werden über die verknüpfte Identität gefunden, nie nur über den Namen.',
+  'bsso.on': 'Entwickler können sich damit im Builder anmelden',
+  'bsso.on_help': 'Die Anmeldeseite zeigt ihn an. Bei dieser Anmeldung entfällt der zweite Faktor von pgkiln: Der Anbieter entscheidet.',
+  'bsso.auto_create': 'Entwickler bei der ersten Anmeldung anlegen',
+  'bsso.auto_create_help': 'Für Mitglieder der unten angegebenen Entwicklergruppe (alle, wenn sie leer ist). Neue Entwickler kommen in den Default-Workspace.',
+  'bsso.link_existing': 'Vorhandenen Entwickler mit demselben Benutzernamen verknüpfen',
+  'bsso.link_existing_help': 'Einmalig, bei der ersten Anmeldung; nie ein Notfall-Administrator. Nur einschalten, wenn Sie den Benutzernamen des Anbieters vertrauen. Sonst verknüpfen Entwickler die Identität auf ihrer Sicherheitsseite.',
+  'bsso.group': 'Entwicklergruppe',
+  'bsso.group_help': 'Nur ihre Mitglieder erhalten ein Entwicklerkonto. Leer: alle, die der Anbieter anmeldet.',
+  'bsso.admin_group': 'Administratorengruppe',
+  'bsso.admin_group_help': 'Wenn gesetzt, sind ihre Mitglieder Administratoren der Instanz und andere nicht, geprüft bei jeder Anmeldung (Notfall-Administratoren behalten ihre Rolle).',
+  'bsso.save': 'Builder-Anmeldung speichern',
+  'bsso.saved': 'Builder-Anmeldung gespeichert.',
+  'bsso.linked': 'Verknüpfte Entwickler',
+  'bsso.none_linked': 'Noch kein Entwickler verknüpft.',
+  'bsso.unlink': 'Verknüpfung lösen',
+  'bsso.unlink_confirm': '{user} lösen? Die Person meldet sich mit dem Kennwort an oder verknüpft erneut.',
+  'bsso.unlink_mine_confirm': '{provider} lösen? Sie können erneut verknüpfen.',
+  'bsso.unlinked': 'Die Identität ist nicht mehr verknüpft.',
+  'bsso.keep_one': 'Ein Workspace verlangt von diesem Entwickler Single Sign-on: Behalten Sie eine verknüpfte Identität.',
+  'bsso.yours': 'Single Sign-on',
+  'bsso.yours_intro': 'Die Identitätsanbieter, mit denen Sie sich im Builder anmelden können.',
+  'bsso.none_yours': 'Noch keine Identität verknüpft.',
+  'bsso.link': '{provider} verknüpfen',
+  'bsso.linked_now': '{provider} ist verknüpft: Sie können sich damit anmelden.',
+  'bsso.directories_note': 'Ein LDAP-Verzeichnis wird bei der ersten Anmeldung damit verknüpft (ein Administrator erlaubt das pro Verzeichnis).',
+  'bsso.break_glass': 'Notfallzugang',
+  'bsso.break_glass_help': 'Darf sich mit dem pgkiln-Kennwort anmelden, wo ein Workspace Single Sign-on verlangt – für den Fall, dass der Identitätsanbieter ausfällt.',
+  'bsso.break_glass_make': 'Notfallzugang geben',
+  'bsso.break_glass_remove': 'Notfallzugang entziehen',
+  'bsso.break_glass_on': '{user} ist Notfall-Administrator. Richten Sie auch einen zweiten Faktor ein.',
+  'bsso.break_glass_off': '{user} ist kein Notfall-Administrator mehr.',
+  'bsso.break_glass_admins': 'Nur Administratoren können Notfallzugang haben.',
+  'bsso.keep_break_glass': 'Ein Workspace verlangt Single Sign-on: Behalten Sie mindestens einen Notfall-Administrator.',
+  'wsp.sso': 'Single Sign-on',
+  'wsp.sso_only': 'Die Entwickler dieses Workspace müssen sich über einen Identitätsanbieter anmelden',
+  'wsp.sso_only_help': 'Oder ein LDAP-Verzeichnis. Das pgkiln-Kennwort und ein Passkey allein werden abgelehnt, außer für Notfall-Administratoren. `pgkiln admin builder-sign-in password` schaltet es ab.',
+  'wsp.sso_unlinked': 'Noch keine verknüpfte Identität (können sich nicht anmelden): {list}.',
+  'wsp.sso_save': 'Single-Sign-on-Regel speichern',
+  'wsp.sso_on': 'Die Entwickler dieses Workspace müssen Single Sign-on verwenden.',
+  'wsp.sso_off': 'Die Entwickler des Workspace dürfen wieder das pgkiln-Kennwort verwenden.',
+  'wsp.sso_no_break_glass': 'Geben Sie zuerst einem Administrator Notfallzugang (Entwickler), damit sich jemand anmelden kann, wenn der Identitätsanbieter ausfällt.',
+  'wsp.sso_link_first': 'Verknüpfen Sie zuerst auf Ihrer Sicherheitsseite eine Identität, sonst könnten Sie sich selbst nicht anmelden.',
 };