feat(be,fe): SSO sign-in via two-hop OIDC discovery

[timothyaterton]

II admins register SSO provider domains via add_discoverable_oidc_config (an update call, not init args). A user then clicks "Sign in with SSO", types their organization domain, and the frontend runs a two-hop discovery chain to resolve the provider's OAuth endpoint before redirecting them to sign in.

Discovery is lazy and user-initiated — the picker does not render one button per organization, just a single "Sign in with SSO" entry that leads to the domain input screen. If the user types a domain that isn't registered, they get "This domain is not registered as an OIDC provider." inline.

Replaces #3786, which is closed.

Changes

Backend

Fix: add_discoverable_oidc_config now refreshes /.config.did.bin

add_oidc_config persisted to state but did not re-certify /.config.did.bin. The certified asset only got rebuilt in initialize(), so runtime SSO registrations never reached the frontend — the SSO feature was unreachable until the next canister upgrade. Added refresh_config_asset() which re-runs init_assets(&config()) + update_root_hash() after every state write.

Removed: oidc_configs from init args

InternetIdentityInit previously carried oidc_configs, but applying it had never been wired through apply_install_arg — it was silently dropped on install/upgrade. Since SSO registration goes through the add_discoverable_oidc_config update call anyway, the init-args slot was a footgun: callers could pass it and get no effect. Removed:

• The oidc_configs field on InternetIdentityInit (Rust + Candid).
• The From<&InternetIdentityInit> for InternetIdentitySynchronizedConfig impl (no longer coherent).
• The oidc_configs line in config()'s return.

InternetIdentitySynchronizedConfig (served as /.config.did.bin) still has oidc_configs — that's how the frontend sees registered domains. get_static_assets builds the synchronized config by pulling openid_configs from the passed-in init config and oidc_configs from persistent state.

setup_oidc at post-upgrade reads from persistent state directly, so the in-memory OIDC_CONFIGS thread-local is correctly repopulated across upgrades without needing the init-arg round-trip.

Frontend

Type alignment with backend. DiscoverableOidcConfig is { discovery_domain: string } — matches the Candid shape exactly.

Two-hop discovery (ssoDiscovery.ts, new).

1. GET https://{domain}/.well-known/ii-openid-configuration returns { client_id, openid_configuration }. The domain owner publishes this at their DNS-backed origin.
2. GET {openid_configuration} is the provider's standard OIDC discovery, yielding authorization_endpoint and scopes_supported.

Both hops run from the browser. (The backend has its own copy in openid/generic.rs; keeping the implementations separate for now minimizes BE↔FE synchronization.)

SSO flow UI.

• SignInWithSso.svelte (new): domain input screen. Framed icon chip (FeaturedIcon), title "Sign In With SSO", subtitle "Enter your company domain", placeholder "company.domain.com". On submit: DNS-validate the input → membership check against oidc_configs from the synchronized config → discoverSsoConfig → continueWithSso → redirect. Unregistered domains render "This domain is not registered as an OIDC provider." inline.
• SsoIcon.svelte (new): key icon.
• PickAuthenticationMethod.svelte: "Continue with passkey" is the top button; OIDC provider icons + SSO key icon render in the row below at equal width. The SSO icon is always rendered — even in deployments with no registered domains, so users know the mechanism exists.
• authFlow.svelte.ts: new signInWithSso view state and continueWithSso() method that synthesizes an OpenIdConfig from discovery results and hands off to the existing continueWithOpenId flow.
• Subtitle text across all three sign-in entry points updated from "Choose method to continue" → "Choose an authentication method to continue" to match the design.

Security.

• Domain input is DNS-format validated (length, label length, forbidden characters).
• oidc_configs from the synchronized config is the sole allowlist of which organizations can initiate SSO — no hardcoded domain list in frontend code.
• All three URLs (/.well-known/ii-openid-configuration, provider discovery, authorization endpoint) must be HTTPS.
• The openid_configuration URL from hop 1 must be on a trusted-provider allowlist (Google, Apple, Microsoft, Okta, login.dfinity.org).
• Issuer and authorization_endpoint hostnames must match the openid_configuration hostname exactly or as a true subdomain — endsWith alone would accept look-alikes like evildfinity.okta.com.
• Per-domain rate limit (1 attempt per 10 min), max 2 concurrent discoveries, 4-hour cache per hop, exponential backoff, timeouts (5s hop 1, 10s hop 2) with clearTimeout in finally.

Tests

• 1 new integration test in http.rs — add_discoverable_oidc_config_refreshes_config_asset: install empty, call the update, assert /.config.did.bin reflects the new registration immediately (no upgrade required).
• config/oidc_configs.rs::should_coexist_with_openid_configs updated to query SSO state via discovered_oidc_configs instead of the removed config().oidc_configs.
• 23 unit tests in ssoDiscovery.test.ts (domain validation, two-hop chain, cache, retry, trusted-provider check, HTTPS enforcement, exact-hostname match for issuer / auth endpoint, off-host rejection).
• 22 unit tests in openID.test.ts preserved, including 4 for selectAuthScopes (shared defaults-fallback helper).
• cargo test -p internet_identity --bin internet_identity: 219/219 pass.
• cargo clippy --all-targets -D warnings: clean.
• npm run lint + svelte-check on touched files: clean.

---

< Previous PR

[Copilot]

Pull request overview

Adds frontend-side OIDC discovery for a new “discoverable” provider configuration list (oidc_configs), enabling the UI/auth flow to fetch provider discovery documents on demand (instead of relying solely on backend-provided openid_configs).

Changes:

• Extend backend config decoding/types to include oidc_configs (discoverable providers with discovery_url + optional client_id).
• Add oidcDiscovery.ts with caching/rate limiting/validation and integrate it into auth + OpenID config lookup.
• Render additional provider buttons for oidc_configs and add unit tests for discovery + config lookup.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/frontend/src/lib/utils/openID.ts	Extend findConfig() to synthesize an OpenIdConfig from cached OIDC discovery + oidc_configs.
src/frontend/src/lib/utils/openID.test.ts	Add tests covering findConfig() behavior with oidc_configs and discovery cache mocking.
src/frontend/src/lib/utils/oidcDiscovery.ts	New module implementing OIDC discovery fetch, validation, caching, concurrency + rate limiting.
src/frontend/src/lib/utils/oidcDiscovery.test.ts	New unit tests for discovery fetch, caching, and validation behavior.
src/frontend/src/lib/globals.ts	Add candid IDL + TS types to decode oidc_configs from .config.did.bin.
src/frontend/src/lib/flows/authFlow.svelte.ts	Add continueWithOidc() that fetches discovery and reuses the existing OpenID flow.
src/frontend/src/lib/components/wizards/auth/views/PickAuthenticationMethod.svelte	Render provider buttons for oidc_configs and wire them to a new handler.
src/frontend/src/lib/components/wizards/auth/AuthWizard.svelte	Wire continueWithOidc handler into the auth wizard flow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aterga]

@copilot-pull-request-reviewer the PR has been restructured significantly in 3d587a1 (see previous comment thread replies). The earlier oidcDiscovery.ts primitive and the eager per-provider OIDC button rendering are removed; the SSO flow is now a single domain-input entry point (SignInWithSso.svelte) with the allowlist sourced from oidc_configs. Please re-review the current state.