pgkiln 0.62.0 → 0.63.0

package/src/builder/i18n/nl.ts

@@ -1820,4 +1820,54 @@ export const nl: BuilderMessages = {
   'wsp.mfa_save': 'Tweestapsregel opslaan',
   'wsp.mfa_on': 'De ontwikkelaars van deze werkruimte hebben tweestapsaanmelding nodig.',
   'wsp.mfa_off': 'De werkruimte verplicht geen tweestapsaanmelding meer (het beleid van de instantie blijft gelden).',
+  'signin.method': 'Aanmelden met',
+  'signin.method_pgkiln': 'pgkiln-account',
+  'signin.with': 'Aanmelden met {provider}',
+  'signin.ldap_unavailable': '{directory} is niet bereikbaar. Probeer het later opnieuw.',
+  'signin.sso_required': 'Uw werkruimte vereist single sign-on: gebruik uw identiteitsprovider.',
+  'signin.sso_unavailable': '{provider} is niet bereikbaar. Probeer het later opnieuw.',
+  'bsso.title': 'Aanmelden bij de builder',
+  'bsso.intro': 'Ontwikkelaars kunnen met deze provider ook bij de builder aanmelden. Ze worden gevonden via de gekoppelde identiteit, nooit alleen via de naam.',
+  'bsso.on': 'Ontwikkelaars kunnen hiermee bij de builder aanmelden',
+  'bsso.on_help': 'De aanmeldpagina toont hem. Zo aanmelden slaat de eigen tweede factor van pgkiln over: de provider beslist.',
+  'bsso.auto_create': 'Ontwikkelaars aanmaken bij hun eerste aanmelding',
+  'bsso.auto_create_help': 'Voor leden van de ontwikkelaarsgroep hieronder (iedereen als die leeg is). Nieuwe ontwikkelaars komen in de werkruimte Default.',
+  'bsso.link_existing': 'Een bestaande ontwikkelaar met dezelfde gebruikersnaam koppelen',
+  'bsso.link_existing_help': 'Eenmalig, bij de eerste aanmelding; nooit een noodbeheerder. Zet het alleen aan als u de gebruikersnamen van de provider vertrouwt. Anders koppelen ontwikkelaars de identiteit op hun beveiligingspagina.',
+  'bsso.group': 'Ontwikkelaarsgroep',
+  'bsso.group_help': 'Alleen de leden krijgen een ontwikkelaarsaccount. Leeg: iedereen die de provider aanmeldt.',
+  'bsso.admin_group': 'Beheerdersgroep',
+  'bsso.admin_group_help': 'Indien ingevuld zijn de leden beheerder van de instantie en anderen niet, gecontroleerd bij elke aanmelding (noodbeheerders houden hun rol).',
+  'bsso.save': 'Aanmelden bij de builder opslaan',
+  'bsso.saved': 'Aanmelden bij de builder opgeslagen.',
+  'bsso.linked': 'Gekoppelde ontwikkelaars',
+  'bsso.none_linked': 'Nog geen ontwikkelaar gekoppeld.',
+  'bsso.unlink': 'Ontkoppelen',
+  'bsso.unlink_confirm': '{user} ontkoppelen? Diegene meldt zich aan met het wachtwoord of koppelt opnieuw.',
+  'bsso.unlink_mine_confirm': '{provider} ontkoppelen? U kunt het opnieuw koppelen.',
+  'bsso.unlinked': 'De identiteit is ontkoppeld.',
+  'bsso.keep_one': 'Een werkruimte vereist single sign-on van deze ontwikkelaar: houd één gekoppelde identiteit.',
+  'bsso.yours': 'Single sign-on',
+  'bsso.yours_intro': 'De identiteitsproviders waarmee u bij de builder kunt aanmelden.',
+  'bsso.none_yours': 'Nog geen identiteit gekoppeld.',
+  'bsso.link': '{provider} koppelen',
+  'bsso.linked_now': '{provider} is gekoppeld: u kunt ermee aanmelden.',
+  'bsso.directories_note': 'Een LDAP-directory wordt gekoppeld als u er voor het eerst mee aanmeldt (een beheerder staat dat per directory toe).',
+  'bsso.break_glass': 'noodtoegang',
+  'bsso.break_glass_help': 'Mag met het pgkiln-wachtwoord aanmelden waar een werkruimte single sign-on vereist, voor als de identiteitsprovider uitvalt.',
+  'bsso.break_glass_make': 'Noodtoegang geven',
+  'bsso.break_glass_remove': 'Noodtoegang intrekken',
+  'bsso.break_glass_on': '{user} is noodbeheerder. Geef diegene ook een tweede factor.',
+  'bsso.break_glass_off': '{user} is geen noodbeheerder meer.',
+  'bsso.break_glass_admins': 'Alleen beheerders kunnen noodtoegang hebben.',
+  'bsso.keep_break_glass': 'Een werkruimte vereist single sign-on: houd minstens één noodbeheerder.',
+  'wsp.sso': 'Single sign-on',
+  'wsp.sso_only': 'De ontwikkelaars van deze werkruimte moeten aanmelden via een identiteitsprovider',
+  'wsp.sso_only_help': 'Of een LDAP-directory. Het pgkiln-wachtwoord en alleen een passkey worden geweigerd, behalve voor noodbeheerders. `pgkiln admin builder-sign-in password` zet het uit.',
+  'wsp.sso_unlinked': 'Nog geen gekoppelde identiteit (kunnen niet aanmelden): {list}.',
+  'wsp.sso_save': 'Single-sign-onregel opslaan',
+  'wsp.sso_on': 'De ontwikkelaars van deze werkruimte moeten single sign-on gebruiken.',
+  'wsp.sso_off': 'De ontwikkelaars van de werkruimte mogen weer het pgkiln-wachtwoord gebruiken.',
+  'wsp.sso_no_break_glass': 'Geef eerst een beheerder noodtoegang (Ontwikkelaars), zodat iemand kan aanmelden als de identiteitsprovider uitvalt.',
+  'wsp.sso_link_first': 'Koppel eerst een identiteit op uw beveiligingspagina, anders kunt u zelf niet aanmelden.',
 };

package/src/builder/i18n/pt.ts

@@ -1820,4 +1820,54 @@ export const pt: BuilderMessages = {
   'wsp.mfa_save': 'Salvar a regra de duas etapas',
   'wsp.mfa_on': 'Os desenvolvedores deste espaço de trabalho precisam do login em duas etapas.',
   'wsp.mfa_off': 'O espaço de trabalho já não exige login em duas etapas (a política da instância continua valendo).',
+  'signin.method': 'Entrar com',
+  'signin.method_pgkiln': 'Conta do pgkiln',
+  'signin.with': 'Entrar com {provider}',
+  'signin.ldap_unavailable': 'Não é possível acessar {directory}. Tente mais tarde.',
+  'signin.sso_required': 'Seu espaço de trabalho exige login único: use seu provedor de identidade.',
+  'signin.sso_unavailable': 'Não é possível acessar {provider}. Tente mais tarde.',
+  'bsso.title': 'Login no builder',
+  'bsso.intro': 'Os desenvolvedores também podem entrar no builder com este provedor. Eles são reconhecidos pela identidade vinculada, nunca só pelo nome.',
+  'bsso.on': 'Os desenvolvedores podem entrar no builder com ele',
+  'bsso.on_help': 'A página de login o mostra. Entrar assim dispensa o segundo fator do próprio pgkiln: o provedor decide.',
+  'bsso.auto_create': 'Criar desenvolvedores no primeiro login',
+  'bsso.auto_create_help': 'Para membros do grupo de desenvolvedores abaixo (qualquer um, se estiver vazio). Novos desenvolvedores entram no espaço de trabalho Default.',
+  'bsso.link_existing': 'Vincular um desenvolvedor existente com o mesmo nome de usuário',
+  'bsso.link_existing_help': 'Uma vez, no primeiro login; nunca um administrador de emergência. Ative só se confiar nos nomes de usuário do provedor. Caso contrário, os desenvolvedores vinculam a identidade na página de segurança.',
+  'bsso.group': 'Grupo de desenvolvedores',
+  'bsso.group_help': 'Só seus membros recebem uma conta de desenvolvedor. Vazio: qualquer pessoa que o provedor autentique.',
+  'bsso.admin_group': 'Grupo de administradores',
+  'bsso.admin_group_help': 'Se preenchido, seus membros são administradores da instância e os demais não, verificado a cada login (administradores de emergência mantêm a função).',
+  'bsso.save': 'Salvar o login no builder',
+  'bsso.saved': 'Login no builder salvo.',
+  'bsso.linked': 'Desenvolvedores vinculados',
+  'bsso.none_linked': 'Ainda não há desenvolvedor vinculado.',
+  'bsso.unlink': 'Desvincular',
+  'bsso.unlink_confirm': 'Desvincular {user}? A pessoa entra com a senha ou vincula de novo.',
+  'bsso.unlink_mine_confirm': 'Desvincular {provider}? Você pode vinculá-lo de novo.',
+  'bsso.unlinked': 'A identidade foi desvinculada.',
+  'bsso.keep_one': 'Um espaço de trabalho exige login único deste desenvolvedor: mantenha uma identidade vinculada.',
+  'bsso.yours': 'Login único',
+  'bsso.yours_intro': 'Os provedores de identidade com que você pode entrar no builder.',
+  'bsso.none_yours': 'Ainda não há identidade vinculada.',
+  'bsso.link': 'Vincular {provider}',
+  'bsso.linked_now': '{provider} está vinculado: você pode entrar com ele.',
+  'bsso.directories_note': 'Um diretório LDAP é vinculado no primeiro login com ele (um administrador permite isso por diretório).',
+  'bsso.break_glass': 'de emergência',
+  'bsso.break_glass_help': 'Pode entrar com a senha do pgkiln onde um espaço de trabalho exige login único, para quando o provedor de identidade falhar.',
+  'bsso.break_glass_make': 'Dar acesso de emergência',
+  'bsso.break_glass_remove': 'Remover acesso de emergência',
+  'bsso.break_glass_on': '{user} é administrador de emergência. Configure também um segundo fator.',
+  'bsso.break_glass_off': '{user} não é mais administrador de emergência.',
+  'bsso.break_glass_admins': 'Só administradores podem ter acesso de emergência.',
+  'bsso.keep_break_glass': 'Um espaço de trabalho exige login único: mantenha pelo menos um administrador de emergência.',
+  'wsp.sso': 'Login único',
+  'wsp.sso_only': 'Os desenvolvedores deste espaço de trabalho devem entrar por um provedor de identidade',
+  'wsp.sso_only_help': 'Ou um diretório LDAP. A senha do pgkiln e uma chave de acesso sozinha são recusadas, exceto para administradores de emergência. `pgkiln admin builder-sign-in password` desativa.',
+  'wsp.sso_unlinked': 'Ainda sem identidade vinculada (não podem entrar): {list}.',
+  'wsp.sso_save': 'Salvar a regra de login único',
+  'wsp.sso_on': 'Os desenvolvedores deste espaço de trabalho devem usar login único.',
+  'wsp.sso_off': 'Os desenvolvedores do espaço de trabalho podem voltar a usar a senha do pgkiln.',
+  'wsp.sso_no_break_glass': 'Primeiro dê acesso de emergência a um administrador (Desenvolvedores), para que alguém possa entrar se o provedor de identidade falhar.',
+  'wsp.sso_link_first': 'Vincule primeiro uma identidade na sua página de segurança, ou você mesmo não conseguiria entrar.',
 };

package/src/builder/ldap.ts

@@ -3,6 +3,7 @@ import { owner } from '../db.ts';
 import { html, raw } from '../html.ts';
 import { testDirectory, type Directory } from '../ldap.ts';
 import { administrator, back, BASE, csrf, flash, input, region, send, shell, type Req } from './ui.ts';
+import { builderSignInRegion } from './builder-sso.ts';
 
 // Users → LDAP directories: the directories an application's password form
 // can check (enabled per app under Settings → Sign-in methods). The bind
@@ -114,6 +115,7 @@ export async function ldapRoutes(app: FastifyInstance) {
           <form method="post" action="${BASE}/users/directories/${d.id}/test" class="search u-mwnone">${csrf(s)}
             <input name="username" placeholder="Username (optional)" aria-label="Username to look up" maxlength="100">
             <button class="btn">Test</button></form>`)}
+        ${await builderSignInRegion(s, 'directory', d)}
       </div>`;
     return send(reply, s, shell(s, d.display_name, [['Users', `${BASE}/users`], ['LDAP directories', `${BASE}/users/directories`], [d.display_name]], main, 'users'));
   });

package/src/builder/routes.ts

@@ -32,6 +32,11 @@ import { isIP } from 'node:net';
 import { giveChallenge, takeChallenge } from './security.ts';
 import { relyingParty, verifyAssertion, WebAuthnError } from '../webauthn.ts';
 import { chooseLanguage, langCookieOptions, languageRoutes, signInLanguageLinks } from './language.ts';
+import { builderSsoRoutes, leavesNoBreakGlass } from './builder-sso.ts';
+import { builderDirectory, builderProvider, builderSources, linkDeveloper, resolveDeveloper, ssoRequired } from '../devsso.ts';
+import { ldapAuthenticate, LdapError } from '../ldap.ts';
+import { onBuilderSso, SsoError, startSignIn } from '../sso.ts';
+import { startSamlSignIn } from '../saml.ts';
 
 // Builder pages: sign-in, workspace and app home, settings, activity and
 // developers. Shared Components, the page designer and the SQL Workshop
@@ -70,6 +75,8 @@ export async function builderRoutes(app: FastifyInstance) {
     const next = safeNext(req.query?.next);
     // (sprint 128) a passkey alone, when the instance allows it and the address is a host name
     const alone = (await passkeySignin()) && !isIP(relyingParty(req).rpId);
+    // (sprint 129, SEC-1) identity providers and directories that sign developers in
+    const sources = await builderSources();
     const field = (name: string, label: string, ic: string, value: string, opts: { type?: string; required?: boolean; auto?: string; placeholder?: string; reveal?: boolean }) =>
       html`<div class="field signin-field"><label class="sr-only" for="f_${name}">${label}</label>
         <div class="signin-input">${icon(ic)}<input id="f_${name}" name="${name}" type="${opts.type ?? 'text'}" value="${value}" placeholder="${opts.placeholder ?? label}"${opts.required ? raw(' required') : ''}${opts.auto ? raw(` autocomplete="${opts.auto}"`) : ''}>
@@ -91,6 +98,10 @@ export async function builderRoutes(app: FastifyInstance) {
               ${error ? html`<div class="alert alert-error" role="alert">${error}</div>` : ''}
               ${csrf(s)}<input type="hidden" name="next" value="${next}">
               ${field('workspace', tx('signin.workspace'), 'database', r?.w ?? '', { placeholder: tx('signin.workspace_placeholder'), auto: 'organization' })}
+              ${sources.directories.length ? html`<div class="field signin-field"><label class="sr-only" for="f_method">${tx('signin.method')}</label>
+                <div class="signin-input">${icon('server')}<select id="f_method" name="method" aria-label="${tx('signin.method')}">
+                  <option value="">${tx('signin.method_pgkiln')}</option>
+                  ${sources.directories.map((d) => html`<option value="ldap:${d.name}">${d.display_name}</option>`)}</select></div></div>` : ''}
               ${field('username', tx('signin.username'), 'user', r?.u ?? '', { required: true, auto: 'username' })}
               ${field('password', tx('signin.password'), 'key', '', { type: 'password', required: true, auto: 'current-password', reveal: true })}
               <label class="check signin-remember"><input type="checkbox" name="remember" value="1"${r ? raw(' checked') : ''}> ${tx('signin.remember')}</label>
@@ -98,6 +109,7 @@ export async function builderRoutes(app: FastifyInstance) {
               ${alone ? html`<input type="hidden" name="credentialId"><input type="hidden" name="clientDataJSON"><input type="hidden" name="authenticatorData"><input type="hidden" name="signature"><input type="hidden" name="userHandle">
                 <button class="btn signin-submit signin-passkey" hidden data-passkey="${BASE}/login/passkey/options" data-passkey-submit="${BASE}/login/passkey" data-passkey-error="${tx('mfa.passkey_failed')}">${icon('fingerprint')} ${tx('signin.passkey')}</button>
                 <p class="small" role="status" data-passkey-status></p>` : ''}
+              ${sources.providers.map((p) => html`<a class="btn signin-submit signin-idp" href="${BASE}/sso/${p.name}${next === `${BASE}/home` ? '' : `?next=${encodeURIComponent(next)}`}">${icon('log-in')} ${tx('signin.with', { provider: p.display_name })}</a>`)}
               <p class="muted small signin-hint">${tx('signin.hint')}</p>
               <nav class="signin-actions" aria-label="${tx('signin.quick')}">
                 <a href="${BASE}/find-workspace">${icon('search')} ${tx('signin.find_ws')}</a>
@@ -135,29 +147,63 @@ export async function builderRoutes(app: FastifyInstance) {
       flash(s, tx('signin.throttled'), 'error');
       return back(reply, s, again);
     }
-    // bcrypt always runs (dummy salt for unknown users) so timing does not reveal accounts
-    const dev = await owner.one(
-      `select d.username, d.language
-         from (select $1::text as u) x
-         left join meta.developer d on d.username = x.u
-        where crypt($2, coalesce(d.password_hash, gen_salt('bf', 10))) = d.password_hash`,
-      [username, password],
-    );
+    // (sprint 129, SEC-1) an LDAP directory checks the password; the developer is the one linked to the entry
+    const method = String(req.body?.method ?? '');
+    const directory = method.startsWith('ldap:') ? await builderDirectory(method.slice(5)) : undefined;
+    if (method && !directory) {
+      flash(s, tx('signin.expired'), 'error');
+      return back(reply, s, again);
+    }
+    let dev: { username: string; language: string | null } | undefined;
+    if (directory) {
+      let why = 'invalid';
+      try {
+        const u = await ldapAuthenticate(directory, username, password);
+        if (u) {
+          const name = await resolveDeveloper({ kind: 'directory', ...directory }, { subject: u.subject, username: u.username, name: u.displayName, email: u.email, mayLink: true, groups: u.groups });
+          dev = await owner.one('select username, language from meta.developer where username = $1', [name]);
+        }
+      } catch (e) {
+        if (!(e instanceof SsoError)) req.log.warn({ err: e, directory: directory.name }, 'builder ldap sign-in failed');
+        why = e instanceof SsoError ? e.message : e instanceof LdapError ? e.message : 'unreachable';
+      }
+      if (!dev) {
+        await logActivity({ username: username.slice(0, 100), event: 'login_failed', ip, detail: `builder ldap:${directory.name}: ${why}` });
+        flash(s, why === 'invalid' ? tx('signin.invalid') : why === 'unreachable' ? tx('signin.ldap_unavailable', { directory: directory.display_name }) : why, 'error');
+        return back(reply, s, again);
+      }
+    } else
+      // bcrypt always runs (dummy salt for unknown users) so timing does not reveal accounts
+      dev = await owner.one(
+        `select d.username, d.language
+           from (select $1::text as u) x
+           left join meta.developer d on d.username = x.u
+          where crypt($2, coalesce(d.password_hash, gen_salt('bf', 10))) = d.password_hash`,
+        [username, password],
+      );
     // a workspace, when given, must be one of the developer's (administrators: any); the same answer otherwise
     const ws = dev && workspace ? await workspaceOf(workspace, dev.username) : undefined;
     if (!dev || (workspace && !ws)) {
-      await logActivity({ username: username.slice(0, 100), event: 'login_failed', ip, detail: workspace ? 'builder (workspace)' : 'builder' });
+      await logActivity({ username: username.slice(0, 100), event: 'login_failed', ip, detail: directory ? `builder ldap:${directory.name} (workspace)` : workspace ? 'builder (workspace)' : 'builder' });
       flash(s, tx(workspace ? 'signin.invalid_ws' : 'signin.invalid'), 'error');
       return back(reply, s, again);
     }
+    // (sprint 129) a workspace of the developer requires single sign-on: not the pgkiln password (break-glass excepted)
+    if (!directory && (await ssoRequired(dev.username))) {
+      await logActivity({ username: dev.username, event: 'login_failed', ip, detail: 'builder: single sign-on required' });
+      flash(s, tx('signin.sso_required'), 'error');
+      return back(reply, s, again);
+    }
+    const weak = !directory && (password === 'admin' || password === dev.username);
+    const detail = directory ? `builder ldap:${directory.name}` : 'builder';
     // (sprint 126, SEC-2) a developer with a second factor: the password was right, the session comes after the code;
     // (sprint 127) unless this browser was trusted after a second factor, for the instance's number of days
     if ((await hasFactor(dev.username)) && !(await isTrustedBrowser(dev.username, req.cookies?.[TRUST_COOKIE]))) {
-      s.state.__MFA = JSON.stringify({ u: dev.username, ws: ws ? String(ws.id) : null, w: workspace, next, remember: req.body?.remember === '1', weak: password === 'admin' || password === dev.username, at: Date.now() });
+      s.state.__MFA = JSON.stringify({ u: dev.username, ws: ws ? String(ws.id) : null, w: workspace, next, remember: req.body?.remember === '1', weak, at: Date.now() });
       await saveState(s);
       return reply.redirect(`${BASE}/login/2fa`, 303);
     }
-    return finishSignIn(req, reply, s, { username: dev.username, language: dev.language }, { ws: ws ? String(ws.id) : null, workspace, next, remember: req.body?.remember === '1', weak: password === 'admin' || password === dev.username, picked, detail: 'builder' });
+    return finishSignIn(req, reply, s, { username: dev.username, language: dev.language }, { ws: ws ? String(ws.id) : null, workspace, next, remember: req.body?.remember === '1', weak, picked, detail });
   });
 
   /** A workspace by name, when it is one of the developer's (administrators: any). */
@@ -170,6 +216,57 @@ export async function builderRoutes(app: FastifyInstance) {
       [workspace, username],
     );
 
+  // (sprint 129, SEC-1) signing in through an identity provider (OpenID Connect or SAML; devsso.ts). The
+  // provider returns to the runtime's callback (/sso/…, registered at the provider for applications too),
+  // which hands sign-ins without an application to the function below.
+  const SSO_COOKIE = 'pgkiln_sso';
+  app.get(`${BASE}/sso/:provider`, async (req: Req, reply) => {
+    const p = await builderProvider(String(req.params.provider));
+    if (!p) return reply.code(404).send('Not found');
+    try {
+      const next = safeNext(req.query?.next);
+      const { url, browserKey } = p.protocol === 'saml' ? await startSamlSignIn(p, null, next) : await startSignIn(p, null, next);
+      reply.setCookie(SSO_COOKIE, browserKey, { path: '/sso', httpOnly: true, sameSite: 'lax', secure: process.env.COOKIE_SECURE === 'true', maxAge: 600 });
+      return reply.redirect(url);
+    } catch (e) {
+      req.log.warn({ err: e }, 'builder sso start failed');
+      const s = await getSession(req, reply, null, BASE);
+      flash(s, translatorFor(validBuilderLanguage(s.state.__BLANG) ?? cookieLanguage(req))('signin.sso_unavailable', { provider: p.display_name }), 'error');
+      return back(reply, s, `${BASE}/login`);
+    }
+  });
+  /** Linking an identity from the Security page (security.ts): the signed-in developer starts it. */
+  app.post(`${BASE}/security/link/:provider`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const p = await builderProvider(String(req.params.provider));
+    if (!p) return reply.code(404).send('Not found');
+    try {
+      const { url, browserKey } = p.protocol === 'saml' ? await startSamlSignIn(p, null, `${BASE}/security`, s.username!) : await startSignIn(p, null, `${BASE}/security`, s.username!);
+      reply.setCookie(SSO_COOKIE, browserKey, { path: '/sso', httpOnly: true, sameSite: 'lax', secure: process.env.COOKIE_SECURE === 'true', maxAge: 600 });
+      return reply.redirect(url, 303);
+    } catch (e) {
+      req.log.warn({ err: e }, 'builder sso link failed');
+      flash(s, tr(s)('signin.sso_unavailable', { provider: p.display_name }), 'error');
+      return back(reply, s, `${BASE}/security`);
+    }
+  });
+  // the end of both (the runtime's callback; SsoError → an error page there)
+  onBuilderSso(async (req: Req, reply, p, result, ip) => {
+    if (!p.builder || !result.identity) throw new SsoError('This identity provider does not sign developers in.');
+    const src = { kind: 'provider' as const, ...p };
+    if (result.link) {
+      // the browser that started this was signed in as result.link (the start needs the session and its CSRF token)
+      await linkDeveloper(src, result.identity.subject, result.link);
+      logActivity({ username: result.link, event: 'sso_linked', ip, detail: p.name });
+      return reply.redirect(`${BASE}/security?linked=${encodeURIComponent(p.name)}`, 303);
+    }
+    const username = await resolveDeveloper(src, { ...result.identity, username: result.username, groups: result.groups });
+    const dev = await owner.one<{ username: string; language: string | null }>('select username, language from meta.developer where username = $1', [username]);
+    if (!dev) throw new SsoError('The developer was removed.');
+    return finishSignIn(req, reply, null, dev, { ws: null, workspace: '', next: safeNext(result.next), remember: false, weak: false, picked: null, detail: `builder sso:${p.name}`, sso: p.name });
+  });
+
   // (sprint 128, SEC-2) signing in with a passkey alone: no user name, no password. The browser offers the
   // passkeys it holds for this site (discoverable credentials); the authenticator must verify the developer
   // (fingerprint, face, PIN), so the passkey counts as both factors. Failures count with wrong passwords.
@@ -219,9 +316,11 @@ export async function builderRoutes(app: FastifyInstance) {
     }
     const ws = !why && workspace ? await workspaceOf(workspace, who) : undefined;
     if (!why && workspace && !ws) why = 'not a workspace of the developer';
+    // (sprint 129) a passkey alone is not single sign-on
+    if (!why && (await ssoRequired(who))) why = 'single sign-on required';
     if (why) {
       await logActivity({ username: who.slice(0, 100), event: 'login_failed', ip, detail: `builder passkey: ${why}` });
-      flash(s, tx(why === 'not a workspace of the developer' ? 'signin.invalid_ws' : 'mfa.passkey_failed'), 'error');
+      flash(s, tx(why === 'not a workspace of the developer' ? 'signin.invalid_ws' : why === 'single sign-on required' ? 'signin.sso_required' : 'mfa.passkey_failed'), 'error');
       return back(reply, s, again);
     }
     const dev = await owner.one<{ username: string; language: string | null }>('select username, language from meta.developer where username = $1', [who]);
@@ -229,12 +328,15 @@ export async function builderRoutes(app: FastifyInstance) {
     return finishSignIn(req, reply, s, dev, { ws: ws ? String(ws.id) : null, workspace, next, remember: req.body?.remember === '1', weak: false, picked, detail: 'builder passkey' });
   });
 
-  /** The session after a successful sign-in (password, and the second factor when the developer has one). */
-  async function finishSignIn(req: Req, reply: Parameters<typeof back>[0], s: Awaited<ReturnType<typeof getSession>>, dev: { username: string; language: string | null },
-    o: { ws: string | null; workspace: string; next: string; remember: boolean; weak: boolean; picked: ReturnType<typeof validBuilderLanguage>; detail: string }) {
+  /**
+   * The session after a successful sign-in (password, and the second factor when the developer has one;
+   * or an identity provider, sso: its name; s null: the sign-in page's session is not at hand there).
+   */
+  async function finishSignIn(req: Req, reply: Parameters<typeof back>[0], s: Awaited<ReturnType<typeof getSession>> | null, dev: { username: string; language: string | null },
+    o: { ws: string | null; workspace: string; next: string; remember: boolean; weak: boolean; picked: ReturnType<typeof validBuilderLanguage>; detail: string; sso?: string }) {
     const ip = clientIp(req);
     const { picked, next, workspace } = o;
-    await destroySession(reply, s, BASE);
+    if (s) await destroySession(reply, s, BASE);
     const ns = await createSession(reply, null, BASE, dev.username);
     // the builder theme chosen earlier on this device
     const theme = validTheme(req.cookies?.[THEME_COOKIE]);
@@ -247,8 +349,12 @@ export async function builderRoutes(app: FastifyInstance) {
       if (dev.language && ns.state.__BLANG !== 'en') reply.setCookie(LANG_COOKIE, ns.state.__BLANG, langCookieOptions());
     }
     if (o.weak) ns.state.__WEAK = '1';
+    // (sprint 129) the identity provider decided on the second factor: no enrolment in pgkiln (ui.ts)
+    if (o.sso) ns.state.__SSO = o.sso;
     await saveState(ns);
-    if (o.remember)
+    if (o.sso) {
+      // the sign-in page's "remember" stays as it was
+    } else if (o.remember)
       reply.setCookie(REMEMBER_COOKIE, Buffer.from(JSON.stringify({ w: workspace, u: dev.username })).toString('base64url'), {
         path: BASE, httpOnly: true, sameSite: 'lax', maxAge: 365 * 24 * 3600, secure: process.env.COOKIE_SECURE === 'true',
       });
@@ -447,6 +553,7 @@ export async function builderRoutes(app: FastifyInstance) {
   await workspaceRoutes(app);
   await instanceRoutes(app);
   await securityRoutes(app);
+  await builderSsoRoutes(app);
   await wizardRoutes(app);
   await appFromFileRoutes(app);
 
@@ -928,7 +1035,10 @@ export async function builderRoutes(app: FastifyInstance) {
   app.get(`${BASE}/developers`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const devs = (await owner.query(`select username, is_admin, email, exists (select 1 from meta.developer_factor f where f.username = d.username) as mfa
+    const devs = (await owner.query(`select username, is_admin, email, break_glass, exists (select 1 from meta.developer_factor f where f.username = d.username) as mfa,
+                                            (select string_agg(coalesce(p.display_name, l.display_name), ', ' order by 1) from meta.developer_identity i
+                                               left join meta.auth_provider p on p.id = i.provider_id left join meta.ldap_directory l on l.id = i.directory_id
+                                              where i.username = d.username) as identities
                                        from meta.developer d order by 1`)).rows;
     const admin = devs.some((d) => d.username === s.username && d.is_admin);
     const me = devs.find((d) => d.username === s.username);
@@ -947,7 +1057,7 @@ export async function builderRoutes(app: FastifyInstance) {
         ${region(tx('dev.accounts'), html`
           <p class="muted u-mt0">${tx('dev.accounts_help')}</p>
           <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>${tx('dev.username')}</th><th>${tx('dev.role')}</th><th>${tx('dev.email_col')}</th><th>${tx('mfa.column')}</th><th></th></tr></thead><tbody>
-            ${devs.map((d) => html`<tr><td data-label="${tx('dev.username')}">${d.username}${d.username === s.username ? ` ${tx('dev.you')}` : ''}</td><td data-label="${tx('dev.role')}">${d.is_admin ? tx('dev.administrator') : tx('dev.developer')}</td>
+            ${devs.map((d) => html`<tr><td data-label="${tx('dev.username')}">${d.username}${d.username === s.username ? ` ${tx('dev.you')}` : ''}</td><td data-label="${tx('dev.role')}">${d.is_admin ? tx('dev.administrator') : tx('dev.developer')}${d.break_glass ? html` <span class="badge badge-warn" title="${tx('bsso.break_glass_help')}">${tx('bsso.break_glass')}</span>` : ''}${d.identities ? html`<br><span class="muted small">${icon('log-in')} ${d.identities}</span>` : ''}</td>
               <td data-label="${tx('dev.email_col')}">${admin && d.username !== s.username
                 ? html`<form method="post" action="${BASE}/developers/email" class="search u-m0 u-mwnone">${csrf(s)}<input type="hidden" name="username" value="${d.username}"><input name="email" type="email" value="${d.email ?? ''}" aria-label="${tx('dev.email_of', { user: d.username })}" placeholder="${tx('dev.none')}"><button class="btn">${tx('dev.save')}</button></form>`
                 : html`<span class="wrap-anywhere">${d.email ?? ''}</span>`}</td>
@@ -955,6 +1065,7 @@ export async function builderRoutes(app: FastifyInstance) {
                   ${input(`reason_${d.username}`.replace(/[^\w]/g, '_'), tx('mfa.reason'), '', { required: true, help: tx('mfa.reset_help', { user: d.username }) })}
                   <button class="btn btn-sm btn-danger">${tx('mfa.reset_btn')}</button></form></div></details>` : ''}` : html`<span class="muted">${tx('mfa.off')}</span>`}</td><td>${d.username === s.username || !admin ? '' : html`
               <form method="post" action="${BASE}/developers/admin" class="u-inline">${csrf(s)}<input type="hidden" name="username" value="${d.username}"><input type="hidden" name="is_admin" value="${d.is_admin ? 'false' : 'true'}"><button class="link-button">${d.is_admin ? tx('dev.make_dev') : tx('dev.make_admin')}</button></form>
+              ${d.is_admin ? html`· <form method="post" action="${BASE}/developers/break-glass" class="u-inline">${csrf(s)}<input type="hidden" name="username" value="${d.username}"><input type="hidden" name="break_glass" value="${d.break_glass ? 'false' : 'true'}"><button class="link-button" title="${tx('bsso.break_glass_help')}">${d.break_glass ? tx('bsso.break_glass_remove') : tx('bsso.break_glass_make')}</button></form>` : ''}
               · <form method="post" action="${BASE}/developers/delete" class="u-inline">${csrf(s)}<input type="hidden" name="username" value="${d.username}"><button class="link-button" data-confirm="${tx('dev.remove_confirm', { user: d.username })}">${tx('dev.remove')}</button></form>`}</td></tr>`)}
           </tbody></table></div>
           ${admin
@@ -1042,7 +1153,12 @@ export async function builderRoutes(app: FastifyInstance) {
         flash(s, tr(s)('mfa.keep_admins'), 'error');
         return back(reply, s, `${BASE}/developers`);
       }
-      await owner.query('update meta.developer set is_admin = $2 where username = $1', [req.body.username, req.body.is_admin === 'true']);
+      // (sprint 129) break-glass is for administrators: a developer loses it, unless they are the last one needed
+      if (req.body.is_admin !== 'true' && (await leavesNoBreakGlass(req.body.username))) {
+        flash(s, tr(s)('bsso.keep_break_glass'), 'error');
+        return back(reply, s, `${BASE}/developers`);
+      }
+      await owner.query('update meta.developer set is_admin = $2, break_glass = break_glass and $2 where username = $1', [req.body.username, req.body.is_admin === 'true']);
       flash(s, tr(s)('dev.role_changed'));
     }
     return back(reply, s, `${BASE}/developers`);
@@ -1053,7 +1169,7 @@ export async function builderRoutes(app: FastifyInstance) {
     if (!s) return;
     if (!(await isAdmin(s.username))) return reply.code(403).send('Only administrators remove developers.');
     if (req.body?.username && req.body.username !== s.username) {
-      if (await leavesTooFewAdmins(req.body.username)) {
+      if ((await leavesTooFewAdmins(req.body.username)) || (await leavesNoBreakGlass(req.body.username))) {
         flash(s, tr(s)('mfa.keep_admins'), 'error');
         return back(reply, s, `${BASE}/developers`);
       }

package/src/builder/security.ts

@@ -14,6 +14,7 @@ import { clientIp, logActivity, saveState, type Session } from '../session.ts';
 import { ALGORITHMS, newChallenge, relyingParty, verifyRegistration, WebAuthnError } from '../webauthn.ts';
 import { tr } from './i18n.ts';
 import { isAdmin } from './locks.ts';
+import { identitiesRegion } from './builder-sso.ts';
 import { back, BASE, csrf, developer, flash, input, region, send, shell, type Req } from './ui.ts';
 
 // (sprint 126, SEC-2 and SEC-6) Developer › Security: a developer's second factors (authenticator apps, TOTP)
@@ -135,7 +136,8 @@ export async function securityRoutes(app: FastifyInstance) {
           ${days || trusted ? html`<h3>${tx('mfa.trusted_title')}</h3>
             <p class="u-mt0">${days ? tx('mfa.trusted_count', { n: trusted, days }) : tx('mfa.trusted_off')}</p>
             ${trusted ? html`<form method="post" action="${BASE}/security/forget-browsers">${csrf(s)}<button class="btn">${tx('mfa.forget_browsers')}</button></form>` : ''}` : ''}`)}
-      </div>`;
+      </div>
+      ${await identitiesRegion(s, typeof req.query?.linked === 'string' ? req.query.linked : undefined)}`;
     return send(reply, s, shell(s, tx('mfa.title'), [[tx('mfa.title')]], main, 'developers'));
   });
 

package/src/builder/ui.ts

@@ -333,7 +333,8 @@ export async function developer(req: Req, reply: FastifyReply) {
     reply.redirect(`${BASE}/developers`);
     return null;
   }
-  const due = await enrolmentDue(s.username, admin);
+  // (sprint 129) signed in through an identity provider: it decides on the second factor
+  const due = s.state.__SSO ? null : await enrolmentDue(s.username, admin);
   if (due?.due === 'grace') s.state.__MFA_DUE = due.until.toISOString();
   else if (due && !weakFirst && !/^\/builder\/(security|logout|language|theme)(?:[/?]|$)/.test(req.url)) {
     reply.redirect(`${BASE}/security`);

package/src/builder/users.ts

@@ -7,6 +7,7 @@ import { accountSettings, clearAccountSettings, passwordProblem } from '../accou
 import { loginMaxFailuresPerUser, loginWindowMinutes } from '../security.ts';
 import { acsUrl, metadataUrl, spEntityId } from '../saml.ts';
 import { discover, publicUrl, redirectUri } from '../sso.ts';
+import { builderSignInRegion } from './builder-sso.ts';
 import { administrator, back, BASE, csrf, developer, flash, input, region, select, send, shell, type Req } from './ui.ts';
 
 // The workspace user directory (like APEX's workspace users with
@@ -476,6 +477,7 @@ export async function usersRoutes(app: FastifyInstance) {
           <p class="muted">${tx.rich('idp.public_url', { env: html`<code>PUBLIC_URL</code>` })}</p>
           <p>${tx.rich('idp.grant', { type: html`<b>${tx('idp.auth_code')}</b>`, scopes: html`<code>${pr.scopes}</code>`, claim: html`<code>${pr.groups_claim}</code>` })}</p>
           <form method="post" action="${BASE}/users/providers/${pr.id}/test">${csrf(s)}<button class="btn">${tx('idp.test')}</button></form>`)}
+        ${await builderSignInRegion(s, 'provider', pr)}
       </div>`;
     return send(reply, s, shell(s, pr.display_name, [['Users', `${BASE}/users`], [tx('idp.title'), `${BASE}/users/providers`], [pr.display_name]], main, 'users'));
   });

package/src/builder/workspaces.ts

@@ -9,6 +9,7 @@ import { icon } from '../icons.ts';
 import { clientIp, logActivity, type BuilderWorkspace, type Session } from '../session.ts';
 import { isAdmin } from './locks.ts';
 import { setWorkspaceRequired } from '../mfa.ts';
+import { breakGlassAdmins } from '../devsso.ts';
 import { back, BANNER_COLORS, BASE, csrf, developer, flash, input, region, select, send, shell, type Req } from './ui.ts';
 
 // Workspaces (064; APEX: workspaces). A workspace groups applications and the
@@ -216,7 +217,7 @@ function serviceRegion(s: Session, w: { id: number; message: string | null; bann
 }
 
 /** (093) Workspace preferences: the SQL Workshop and the applications' REST modules on or off. */
-function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; rest_services: boolean; builder_home: string | null; mfa_required_since: Date | null }, without: string[]) {
+function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; rest_services: boolean; builder_home: string | null; mfa_required_since: Date | null; sso_only: boolean }, without: string[], unlinked: string[]) {
   const check = (name: string, on: boolean, label: string, help: string) =>
     html`<div class="field"><label class="check"><input type="checkbox" name="${name}" value="true"${on ? raw(' checked') : ''}> ${label}</label><small class="help">${help}</small></div>`;
   const tx = tr(s);
@@ -229,7 +230,12 @@ function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; r
     <form method="post" action="${BASE}/workspaces/${w.id}/mfa">${csrf(s)}
       ${check('required', !!w.mfa_required_since, tx('wsp.mfa_required'), tx('wsp.mfa_required_help'))}
       ${w.mfa_required_since ? html`<p class="small">${tx('wsp.mfa_since', { date: new Date(w.mfa_required_since).toISOString().slice(0, 10) })}${without.length ? html` ${tx('wsp.mfa_without', { list: without.join(', ') })}` : ''}</p>` : ''}
-      <div class="buttons"><button class="btn">${tx('wsp.mfa_save')}</button></div></form>`, '', 'preferences');
+      <div class="buttons"><button class="btn">${tx('wsp.mfa_save')}</button></div></form>
+    <h3 id="sso">${tx('wsp.sso')}</h3>
+    <form method="post" action="${BASE}/workspaces/${w.id}/sso">${csrf(s)}
+      ${check('sso_only', w.sso_only, tx('wsp.sso_only'), tx('wsp.sso_only_help'))}
+      ${w.sso_only && unlinked.length ? html`<p class="small">${tx('wsp.sso_unlinked', { list: unlinked.join(', ') })}</p>` : ''}
+      <div class="buttons"><button class="btn">${tx('wsp.sso_save')}</button></div></form>`, '', 'preferences');
 }
 
 /** (093) Extension links: links to other tools in the builder's Extensions menu. */
@@ -351,6 +357,11 @@ export async function workspaceRoutes(app: FastifyInstance) {
     const without = (await owner.query<{ username: string }>(
       `select m.username from meta.workspace_member m where m.workspace_id = $1
           and not exists (select 1 from meta.developer_factor f where f.username = m.username) order by 1`, [w.id])).rows.map((r) => r.username);
+    // (sprint 129) the members who could not sign in while single sign-on is required: no linked identity, not break-glass
+    const unlinked = (await owner.query<{ username: string }>(
+      `select m.username from meta.workspace_member m join meta.developer d on d.username = m.username
+        where m.workspace_id = $1 and not d.break_glass
+          and not exists (select 1 from meta.developer_identity i where i.username = m.username) order by 1`, [w.id])).rows.map((r) => r.username);
     const main = html`
       <div class="title-row"><h1>${w.name}</h1></div>
       <div class="columns wide-left">
@@ -375,7 +386,7 @@ export async function workspaceRoutes(app: FastifyInstance) {
       </div>
       ${serviceRegion(s, w)}
       ${region(tx('wsp.mail_net'), html`<p class="u-mt0">${tx.rich('wsp.mail_net_text', { mail: html`<a href="${BASE}/workspaces/${w.id}/mail">${tx('wsp.mail_service')}</a>`, network: html`<a href="${BASE}/network?ws=${w.id}">${tx('wsp.network')}</a>`, queue: html`<a href="${BASE}/mail-queue${full ? `?ws=${w.id}` : ''}">${tx('wsp.queue')}</a>` })}</p>`, '', 'mail-network')}
-      <div class="columns">${preferencesRegion(s, w, without)}${linksRegion(s, w, links)}</div>
+      <div class="columns">${preferencesRegion(s, w, without, unlinked)}${linksRegion(s, w, links)}</div>
       ${full ? isolationRegion(s, w, roles.rows) : region(tx('wsp.isolation'), html`<p class="u-mt0">${w.isolated ? tx('wsp.iso_short_on') : tx('wsp.iso_short_off')} ${tx('wsp.admins_change')}</p>`)}
       ${!full ? '' : region(tx('wsp.applications'), html`<div class="table-wrap"><table class="report report-reflow">
         <thead><tr><th>${tx('wsp.application')}</th><th>${tx('wsp.move_to')}</th></tr></thead>
@@ -580,6 +591,29 @@ export async function workspaceRoutes(app: FastifyInstance) {
     return back(reply, s, `${BASE}/workspaces/${req.params.id}#mfa`);
   });
 
+  // (sprint 129, SEC-1) a workspace requires single sign-on of its developers: not while no break-glass
+  // administrator could sign in with the password, and not by someone who would lock themselves out
+  app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/sso`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
+    const tx = tr(s);
+    const on = req.body?.sso_only === 'true';
+    if (on && !(await breakGlassAdmins()).length) {
+      flash(s, tx('wsp.sso_no_break_glass'), 'error');
+      return back(reply, s, `${BASE}/workspaces/${req.params.id}#sso`);
+    }
+    if (on && !(await owner.one(`select 1 as ok from meta.developer d where d.username = $1
+        and (d.break_glass or exists (select 1 from meta.developer_identity i where i.username = d.username))`, [s.username]))) {
+      flash(s, tx('wsp.sso_link_first'), 'error');
+      return back(reply, s, `${BASE}/workspaces/${req.params.id}#sso`);
+    }
+    const r = await owner.query('update meta.workspace set sso_only = $2 where id = $1', [req.params.id, on]);
+    if (!r.rowCount) return reply.code(404).send('Not found');
+    await logActivity({ appId: null, username: s.username, event: 'sso_policy', ip: clientIp(req), detail: `workspace ${req.params.id}: single sign-on ${on ? 'required' : 'not required'}` });
+    flash(s, tx(on ? 'wsp.sso_on' : 'wsp.sso_off'));
+    return back(reply, s, `${BASE}/workspaces/${req.params.id}#sso`);
+  });
+
   // (093) extension links
   app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/links`, async (req: Req, reply) => {
     const s = await developer(req, reply);

package/src/cli/main.ts

@@ -471,15 +471,18 @@ const COMMANDS: Record<string, Command> = {
   },
   // (sprint 126, SEC-6) lockout recovery on the server, when nobody can sign in to the builder
   admin: {
-    usage: 'pgkiln admin reset-2fa <developer> | set-2fa-policy off|admins|all [options]',
-    summary: 'lockout recovery: reset a developer\'s two-factor sign-in, set the two-factor policy',
+    usage: 'pgkiln admin reset-2fa <developer> | set-2fa-policy off|admins|all | builder-sign-in password [options]',
+    summary: 'lockout recovery: reset a developer\'s two-factor sign-in, set the two-factor policy, allow the password again',
     details:
       'pgkiln admin reset-2fa <developer> [--reason <text>]\n' +
-      'pgkiln admin set-2fa-policy off|admins|all [--grace <days>]\n\n' +
+      'pgkiln admin set-2fa-policy off|admins|all [--grace <days>]\n' +
+      'pgkiln admin builder-sign-in password\n\n' +
       "reset-2fa removes the developer's authenticator apps and recovery codes and ends their builder\n" +
       'sessions; they sign in with the password and set up an app again. set-2fa-policy off always works\n' +
       "(and clears the workspaces' own two-factor rules); admins and all need at least two administrators\n" +
-      'with two-factor sign-in (or every one, when there are fewer). Both are written to the activity log and mailed to the administrators.',
+      'with two-factor sign-in (or every one, when there are fewer). builder-sign-in password turns off the\n' +
+      "workspaces' single sign-on rule, for when the identity provider fails and no break-glass administrator\n" +
+      'can sign in. All are written to the activity log and mailed to the administrators.',
     options: { reason: { type: 'string' }, grace: { type: 'string' } },
     optionHelp: [
       ['--reason <text>', 'reset-2fa: why (in the activity log and the mail)'],
@@ -516,7 +519,18 @@ const COMMANDS: Record<string, Command> = {
           out(`Two-factor policy: ${policy}${policy === 'off' ? '' : `, grace ${grace} days`}.${cleared ? ` ${cleared} workspace(s) no longer require it.` : ''}${sent ? ` ${sent} administrator(s) told by mail.` : ''}\n`);
           return EXIT.ok;
         }
-        throw new UsageError(`unknown action ${action}: use reset-2fa or set-2fa-policy`);
+        // (sprint 129, SEC-1) every workspace allows the pgkiln password again
+        if (action === 'builder-sign-in') {
+          if (arg !== 'password') throw new UsageError('builder-sign-in takes password');
+          const { clearSsoOnly } = await import('../devsso.ts');
+          const cleared = await clearSsoOnly();
+          await logActivity({ event: 'sso_policy', ip: 'cli', detail: `password sign-in allowed again, ${cleared} workspace rule(s) cleared (${by})` });
+          const sent = await mfa.notifyMfa(await mfa.adminEmails(), 'pgkiln: the builder password works again',
+            `${by} turned off the single sign-on rule of ${cleared} workspace(s) on the server: developers may sign in with the pgkiln password.`);
+          out(`Developers may sign in with the pgkiln password again; ${cleared} workspace(s) no longer require single sign-on.${sent ? ` ${sent} administrator(s) told by mail.` : ''}\n`);
+          return EXIT.ok;
+        }
+        throw new UsageError(`unknown action ${action}: use reset-2fa, set-2fa-policy or builder-sign-in`);
       } finally {
         await closePools();
       }