Sign in for real, and decide who gets in

.env.example

@@ -11,21 +11,41 @@ TENANT_PACKAGE_DIR=../examples/fintech
 # deployment mints, so its own conversations stay identifiable. Unset, the tenant package's id is
 # used, which tells two packages apart but not two copies of one.
 # DEPLOYMENT_ID=
-# Google sign-in. Leave commented for local development with OPENBOT_DEV_NO_AUTH; uncomment all five
-# settings together so authentication is either fully configured or absent.
-#
-# BETTER_AUTH_SECRET must be a high-entropy secret of at least 32 characters. Generate one:
-#   openssl rand -base64 32
-# TRUSTED_ORIGINS is where the app is served from, which is port 3010 locally.
+# Sign-in. All of this is commented out, and a clone with none of it set is one administrator with
+# no sign-in at all, which is how you reach the product without registering an OAuth client first.
+# Somewhere other people can get to, an unconfigured deployment refuses to start rather than serving
+# an open one. OPENBOT_SINGLE_USER=true says you meant it.
+#
+# Configure ANY ONE of the three providers to turn sign-in on. Configure several and the sign-in
+# screen offers several, which is the normal shape for a company mid-migration.
+#
+# These four are needed whichever provider you pick:
+#   BETTER_AUTH_URL is where OAuth callbacks come back to, which is the API on port 3001.
+#   BETTER_AUTH_SECRET signs session cookies. At least 32 characters: openssl rand -base64 32
+#   TRUSTED_ORIGINS is where the app is served from, which is port 3010 locally.
+#   INITIAL_ADMIN_EMAILS names who is an administrator. Required, because nothing else grants the
+#   role and no screen can promote somebody later. Re-read on every sign-in, so editing it works.
 # BETTER_AUTH_URL=http://localhost:3001
 # BETTER_AUTH_SECRET=
+# INITIAL_ADMIN_EMAILS=admin@example.com
+#
+# Google. Redirect URI: http://localhost:3001/api/auth/callback/google
 # GOOGLE_OAUTH_CLIENT_ID=
 # GOOGLE_OAUTH_CLIENT_SECRET=
-# INITIAL_ADMIN_EMAILS=admin@example.com
+#
+# Microsoft (Entra ID). Redirect URI: http://localhost:3001/api/auth/callback/microsoft
+# MICROSOFT_OAUTH_TENANT_ID defaults to `common`, which admits personal Microsoft accounts as well
+# as work ones. Put your directory GUID here if you mean only your own company.
+# MICROSOFT_OAUTH_CLIENT_ID=
+# MICROSOFT_OAUTH_CLIENT_SECRET=
+# MICROSOFT_OAUTH_TENANT_ID=common
+#
+# Okta. Redirect URI: http://localhost:3001/api/auth/callback/okta
+# The issuer is what makes it your Okta rather than Okta in general.
+# OKTA_OAUTH_CLIENT_ID=
+# OKTA_OAUTH_CLIENT_SECRET=
+# OKTA_OAUTH_ISSUER=https://example.okta.com/oauth2/default
 
-# Local development only. This admits every request as one local administrator. Keep it explicit and
-# never expose a deployment to the internet in this state; production refuses to start with it.
-OPENBOT_DEV_NO_AUTH=true
 TRUSTED_ORIGINS=http://localhost:3010
 
 # CopilotKit Intelligence. Required: the server refuses to start without all four because

.github/workflows/ci.yml

@@ -145,6 +145,12 @@ jobs:
       - name: The image boots and serves
         run: |
           set -euo pipefail
+          # `OPENBOT_SINGLE_USER=true` because this boots a deployment with no identity provider, and
+          # the image sets NODE_ENV=production, where that combination refuses to start rather than
+          # serve an open deployment. Saying so is the point: the flag is how somebody declares they
+          # meant it. This was `OPENBOT_DEV_NO_AUTH=1` before, which the code never accepted at all,
+          # since it compares against the exact string "true"; it did nothing and nothing noticed.
+          #
           # Placeholders, not secrets. `loadConfig` refuses to start without Intelligence and a
           # licence configured, but it only checks that they are present and well-formed; nothing is
           # contacted at start-up and /api/capabilities reads config alone. So this proves the image
@@ -155,7 +161,7 @@ jobs:
             -e EMBEDDED_POSTGRES=on \
             -e KEY_ENCRYPTION_KEY="$(openssl rand -base64 32)" \
             -e TRUSTED_ORIGINS=http://localhost:3001 \
-            -e OPENBOT_DEV_NO_AUTH=1 \
+            -e OPENBOT_SINGLE_USER=true \
             -e MANAGED_AGENT_AG_UI_URL=http://127.0.0.1:4201/ag-ui \
             -e MANAGED_AGENT_TOKEN=ci-not-a-real-token \
             -e INTELLIGENCE_API_URL=https://api.intelligence.copilotkit.ai \

CHANGELOG.md

@@ -8,6 +8,15 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
 
 ## Unreleased
 
+### Upgrading
+
+Two configurations now refuse to start:
+
+- A provider configured with no `INITIAL_ADMIN_EMAILS`. Set it to at least one address.
+- No provider at all with `NODE_ENV=production`. Configure one, or set `OPENBOT_SINGLE_USER=true`.
+
+Sessions survive and nobody signs in again.
+
 ### Added
 
 - **Releases are cut by a workflow, not by hand.** `Create release PR` bumps the version and promotes
@@ -22,6 +31,24 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
   supervised service is respawning. A single `verify` check covers every job, so branch protection
   needs one entry. The same checks run again against the release commit when a release is published,
   so they gate the release rather than the proposal for one.
+- **Sign in with Google, Microsoft or Okta.** Any one of them turns sign-in on; configure several
+  and the sign-in screen offers each, on matching buttons carrying each provider's own mark.
+  `INITIAL_ADMIN_EMAILS` says who is an administrator. It is required whenever a provider is
+  configured, because nothing else grants the role, and it is now a floor rather than a one-off:
+  an address it names is made an administrator at every sign-in, so adding somebody to the list
+  works even after they have already signed in.
+- **SAML and OpenID Connect, registered while running.** `/admin/identity-providers` takes the
+  metadata a company's identity team supplies and registers their own IdP. Somebody then types their
+  email address on the sign-in screen and the domain decides which provider they are sent to, so a
+  company mid-merger can run two. Registering, changing or removing one is administrator-only, which
+  the upstream plugin does not require: it guards those routes with a session, and anybody who could
+  reach them could register a provider for a domain and mint themselves colleagues.
+- **A People screen.** `/admin/people` lists everybody who has signed in, with the provider they came
+  through and when they were last here, and lets an administrator promote, demote, or remove
+  somebody. Removing ends the session they are using and stops the next sign-in, keyed on the
+  address so signing in again through the provider does not quietly create a new account. Every
+  change is on the audit trail. Somebody named in `INITIAL_ADMIN_EMAILS` cannot be demoted or
+  removed here, and nobody can do either to themselves.
 - **One container that runs the whole thing.** The root `Dockerfile` builds an image carrying the
   app, the API, a Bot computer, and optionally PostgreSQL, supervised together. Point `DATABASE_URL`
   at a database you already run and the built-in one never starts; leave it unset and the container
@@ -92,6 +119,14 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
 
 ### Changed
 
+- **A deployment with no identity provider is one administrator, without a flag.** That is how a
+  fresh clone reaches the product. Where `NODE_ENV=production`, an unconfigured deployment now
+  refuses to start instead, because a public URL where every visitor is an administrator is silent
+  and looks like it works. `OPENBOT_SINGLE_USER=true` replaces `OPENBOT_DEV_NO_AUTH`, which is still
+  honoured, and is how somebody says they meant an open deployment.
+- **Requires Better Auth 1.7**, which adds an `issuer` to every account. Migrations `0002` to `0004`
+  add the column, backfill existing rows with their provider's real issuer, and then make it
+  required, so nobody is asked to sign in again.
 - **Where a Bot's computer runs is now a plug.** One `ComputerProvider` interface sits under the
   gateway, with the Docker supervisor as one implementation and a shared computer as another. A
   computer somewhere else is an adapter rather than a change to the governed path. Thanks to

README.md

@@ -27,7 +27,7 @@ your own machine.
 
 > **Alpha, and under active development.** OpenBot is early. Expect rough edges and bugs, and expect things to move. Issues and pull requests are welcome.
 
-> **Runs on your machine.** Everything below is written for a laptop. Out of the box OpenBot runs with `OPENBOT_DEV_NO_AUTH`, which skips signing in and admits every request as one administrator. [Google sign-in](#sign-in-with-google) can be wired up instead.
+> **Runs on your machine.** Everything below is written for a laptop. With no identity provider configured OpenBot admits every request as one administrator, so a fresh clone reaches the product without registering an OAuth client. [Sign-in](#sign-in) turns that off.
 
 ## What it is
 
@@ -149,6 +149,8 @@ as one replica for now.
 - **Components instead of prose**: compiled React components live in `app/src/components/gallery/`, sandboxed ones are authored in `/admin/playground` and published with no deployment. Every call asks the server whether the component exists, is published, and is not withheld from that Bot. Data functions are granted per component.
 - **Governed MCP**: a curated catalogue ships for Atlassian, Box, Slack, Salesforce and ServiceNow. Custom servers must pass URL checks, and any tool not positively classified as a read is treated as a write.
 - **Skills are instructions, not capabilities**: personal skills attach only to Bots their author owns, deployment skills are admin-owned, and both are invoked with `/` in the composer.
+- **Sign in with what your company already has**: Google, Microsoft or Okta from the environment, or a company's own SAML or OpenID Connect provider registered while the deployment runs and routed by email domain. Any one turns sign-in on; several may be configured at once.
+- **Decide who gets in**: `/admin/people` lists everybody who has signed in, promotes and demotes them, and removes access, which ends the session they are using and stops the next sign-in. Every change is on the audit trail.
 - **An audit trail you can read**: `/admin/audit` lists what was permitted, what was refused and what failed, and every refusal carries the rule that caused it.
 - **Credentials encrypted at rest**: stored through `/admin/credentials`, never returned by an API, and redacted from audit events.
 - **Loopback by default**: computers bind to `127.0.0.1` and require a per-container token, so nothing reaches a logged-in browser by knowing its port.
@@ -191,7 +193,7 @@ Settings worth knowing:
 
 | Variable                             | Use                                                                       |
 | ------------------------------------ | ------------------------------------------------------------------------- |
-| `OPENBOT_DEV_NO_AUTH`                | Admits every request as one administrator. How OpenBot runs today.        |
+| `OPENBOT_SINGLE_USER`                | Admits every request as one administrator where an unconfigured deployment would otherwise refuse to start. |
 | `OPENAI_BASE_URL`                    | Answers the OpenAI-shaped calls from somewhere else: a gateway, a proxy.  |
 | `ANTHROPIC_BASE_URL`, `GOOGLE_GENERATIVE_AI_BASE_URL` | The same, for those two APIs.            |
 | `COMPUTER_TOKEN`                     | Secret every Bot computer request must present. `start.sh` sets one.      |
@@ -227,25 +229,58 @@ endpoints; keep them private and do not use them to bypass the gateway.
 
 More detail: [docs/architecture.md](docs/architecture.md).
 
-## Sign in with Google
+## Sign in
 
-`OPENBOT_DEV_NO_AUTH` is the default because it needs no OAuth credentials and no consent screen. To sign in for real instead, create a Google OAuth client and set all four of these together:
+Nothing configured means one administrator and no sign-in, which is how a fresh clone reaches the
+product. Configure **any one** of Google, Microsoft or Okta to turn sign-in on. Configure more than
+one and the sign-in screen offers each of them.
+
+These four are needed whichever you pick:
 
 ```sh
-BETTER_AUTH_URL=http://localhost:3001
-BETTER_AUTH_SECRET=        # openssl rand -base64 32, at least 32 characters
-GOOGLE_OAUTH_CLIENT_ID=
-GOOGLE_OAUTH_CLIENT_SECRET=
+BETTER_AUTH_URL=http://localhost:3001        # where OAuth callbacks come back to
+BETTER_AUTH_SECRET=                          # openssl rand -base64 32
+TRUSTED_ORIGINS=http://localhost:3010        # where the app is served from
+INITIAL_ADMIN_EMAILS=you@example.com         # comma separated
 ```
 
-Then set the two that decide who gets in and from where:
+Then the provider. Register the redirect URI shown beside it.
+
+```sh
+# Google — http://localhost:3001/api/auth/callback/google
+GOOGLE_OAUTH_CLIENT_ID=
+GOOGLE_OAUTH_CLIENT_SECRET=
 
-- `TRUSTED_ORIGINS` — where the app is served from, `http://localhost:3010` locally. It defaults to `http://localhost:3000`, which is not where `start.sh` serves the app.
-- `INITIAL_ADMIN_EMAILS` — comma separated. An address listed here becomes an administrator the first time it signs in; everybody else becomes a user.
+# Microsoft — http://localhost:3001/api/auth/callback/microsoft
+MICROSOFT_OAUTH_CLIENT_ID=
+MICROSOFT_OAUTH_CLIENT_SECRET=
+MICROSOFT_OAUTH_TENANT_ID=common             # your directory GUID for staff only
 
-Remove `OPENBOT_DEV_NO_AUTH`, then restart: the sign-in button is written into the app's generated config at startup, so it appears only once all four settings are present. Accounts, sessions and roles are stored in the same PostgreSQL database as everything else.
+# Okta — http://localhost:3001/api/auth/callback/okta
+OKTA_OAUTH_CLIENT_ID=
+OKTA_OAUTH_CLIENT_SECRET=
+OKTA_OAUTH_ISSUER=https://example.okta.com/oauth2/default
+```
 
-A partial set is refused rather than ignored: the server will not start with `BETTER_AUTH_SECRET` or `BETTER_AUTH_URL` but no client credentials, or with a secret shorter than 32 characters.
+Restart. Accounts, sessions and roles are stored in the same PostgreSQL database as everything else.
+
+- `INITIAL_ADMIN_EMAILS` is required, because nothing else grants the administrator role and no
+  screen can promote somebody afterwards. It is re-read on every sign-in, so editing it takes effect
+  the next time that person signs in.
+- `MICROSOFT_OAUTH_TENANT_ID` defaults to `common`, which admits personal Microsoft accounts as well
+  as work ones. On a multi-tenant app registration Entra may send no `email` claim at all, so
+  OpenBot falls back to `upn` and then `preferred_username`. If none of the three arrives the
+  sign-in is refused and the reason is logged: add `email` as an optional claim, or use your
+  directory GUID here.
+- A half-configured provider is refused at start-up rather than at somebody's first attempt to sign
+  in: a client id with no secret, a secret shorter than 32 characters, or an Okta issuer with no
+  credentials behind it.
+- **SAML and OIDC** are registered while the deployment runs rather than configured here. Sign in as
+  an administrator and go to Admin → Identity providers with the metadata your identity team gave
+  you. People then sign in by typing their email address, and the domain decides which provider
+  they are sent to.
+- **Put TLS in front of any deployment.** A page served over plain `http://` on anything but
+  localhost is not a secure context, and sign-in cookies want `Secure`.
 
 ## Keeping it to your machine
 
@@ -280,6 +315,8 @@ Use `bash scripts/start.sh` for the whole stack. Use `bun run dev` only when you
 - [docs/configuration.md](docs/configuration.md)
 - [docs/development.md](docs/development.md)
 - [docs/coworkers.md](docs/coworkers.md)
+- [docs/deployment.md](docs/deployment.md)
+- [docs/releasing.md](docs/releasing.md)
 
 ## Contributing
 

app/package.json

@@ -15,6 +15,7 @@
   "dependencies": {
     "@ag-ui/core": "0.0.57",
     "@base-ui/react": "^1.6.0",
+    "@better-auth/sso": "^1.7.1",
     "@copilotkit/react-core": "1.68.3",
     "@fontsource-variable/inter": "^5.3.0",
     "@shadcn/react": "^0.3.0",

app/src/components/admin/admin-sidebar.tsx

@@ -1,5 +1,6 @@
 import {
   IconArrowLeft,
+  IconBuildingBank,
   IconCode,
   IconDeviceDesktop,
   IconKey,
@@ -8,6 +9,7 @@ import {
   IconPlugConnected,
   IconPuzzle,
   IconShieldCheck,
+  IconUsers,
 } from "@tabler/icons-react";
 import { Link, type LinkOptions } from "@tanstack/react-router";
 import type * as React from "react";
@@ -86,6 +88,21 @@ const GROUPS: {
       },
     ],
   },
+  {
+    label: "Who can get in",
+    items: [
+      {
+        title: "People",
+        icon: IconUsers,
+        linkOptions: { to: "/admin/people" },
+      },
+      {
+        title: "Identity providers",
+        icon: IconBuildingBank,
+        linkOptions: { to: "/admin/identity-providers" },
+      },
+    ],
+  },
   {
     label: "What happened",
     items: [