Description

Ensure SAML single sign-on (SSO) is configured for the Supabase organization with the company's identity provider, and that members join and sign in using their SSO accounts. Only one non-SSO Owner account should remain, kept as a break-glass account for emergency access.

Rationale

Without SSO, each member signs in with a separate password or GitHub login that the company does not control, and offboarding depends on removing people manually. With SSO, the identity provider controls access, applies company MFA rules, and removes access as soon as a user is disabled. This greatly reduces the risk of former staff keeping access to production projects.

Impact

  • Sign-in to the organization is controlled by the identity provider

  • Disabled IdP users can no longer sign in

  • Existing non-SSO members must be re-invited with SSO accounts

Default Value

By default, SSO is not configured. SAML SSO is available on the Team and Enterprise plans.

Pre-Requisites

  • Organization Owner role

  • Team or Enterprise plan

  • Admin access to the identity provider

  • One non-SSO Owner account kept for emergency access

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your organization.

  3. Open Organization Settings and select SSO.

  4. Verify that an SSO provider is configured and enabled.

  5. Open Organization Settings and select Team, and verify that all members except the break-glass Owner use SSO accounts.

  6. If SSO is not configured or non-SSO members remain, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your organization.

  3. Open Organization Settings and select SSO.

  4. Configure your identity provider using the provider-specific guide, and keep auto-join disabled at first.

  5. Test signing in with your own SSO account.

  6. Invite members with SSO-required invitations, then remove their old non-SSO accounts from the Team page.

  7. Keep one non-SSO Owner account for emergency access.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your organization.

  3. Confirm that a non-SSO Owner account can sign in.

  4. Open Organization Settings and select SSO.

  5. Disable the SSO provider. Note that SSO users will immediately be unable to sign in.

Reference