An SsoConfig holds the single sign-on setup for one workspace. The protocol field selects SAML or OIDC, and enabled turns it on. For SAML, idpEntityId, idpSsoUrl, and idpCertificate describe the identity provider; for OIDC, oidcIssuer, oidcClientId, and oidcClientSecret do the same. autoProvision lets new users be created on first login, disablePassword can force everyone through SSO, and allowedDomains restricts which email domains may authenticate. Together these settings let a tenant delegate login to its own corporate identity provider.
Technical section
Data model, API, and internals — visible to developers.