oauth providers & configuration

24 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Steps to enable a social provider in Supabase

To enable a social provider in Supabase: Go to your Supabase Project Dashboard. In the left sidebar, click the Authentication icon near the top. Click on Providers under the Configuration section. Click on the provider name from the accordion list to expand it. Turn the provider's Enabled toggle to ON. Enter your provider's Client ID and Client Secret. Click Save.

Migrate OAuth users from Auth0 to Supabase

Configure OAuth providers in Supabase by following the Social login guides. For both new and existing users, sign in using the signInWithOAuth method. This works without pre-migrating existing users since the user always needs to sign in through the OAuth provider before being redirected to your service. After successful OAuth flow, check if the user is new or existing in Auth0 by mapping their social provider id to Auth0. Auth0 stores the social provider ID in the user ID with format provider_name|provider_id (e.g., github|123456).

SAML SSO migration from Auth0 to Supabase

Customers may need to link their identity provider with Supabase Auth separately, but users should still be able to sign in as per normal after authenticating with their identity provider. For more information about SSO with SAML 2.0, see the SAML guide. If you want to migrate existing SAML SSO connections from Auth0 to Supabase Auth, reach out via support.

Google Workspace SSO availability

Single sign-on with Google Workspace is only available on Team and Enterprise Plans.

Google Workspace SSO ACS URL

The Assertion Consumer Service (ACS) URL for Google Workspace SSO configuration is https://alt.supabase.io/auth/v1/sso/saml/acs.

Google Workspace SSO Entity ID

The Entity ID for Google Workspace SSO configuration is https://alt.supabase.io/auth/v1/sso/saml/metadata.

Google Workspace SSO Start URL

The Start URL for Google Workspace SSO configuration is https://supabase.com/dashboard.

Google Workspace SSO Name ID format

The Name ID format for Google Workspace SSO must be set to PERSISTENT.

Google Workspace SSO Name ID attribute

The Name ID attribute for Google Workspace SSO should be set to Primary email from Basic Information.

Google Workspace SSO primary email attribute mapping

A mapping from Primary email to the email attribute is required for Google Workspace SSO configuration. This allows Supabase to retrieve user email information on each sign-in.

Google Workspace SSO attribute mapping requirements

Other attribute mappings beyond the required Primary email to email mapping are optional and configurable depending on your Google Workspace setup.

Google Workspace SSO metadata certificate expiration check

When downloading IdP metadata from Google Workspace, verify that the certificate has at least 1 year before expiration. Expired certificates are a common cause of SSO sign-in failures.

Google Workspace SSO certificate renewal reminder

Set a calendar reminder 30 days before the certificate expiration date. When the certificate is renewed, download the new metadata file and update it in Supabase SSO settings.

Google Workspace SSO user access configuration propagation delay

Changes to user access configuration in Google Workspace sometimes take a while to propagate across Google's systems. Wait at least 15 minutes before testing changes.

Supabase SSO domain configuration

Enter one or more domains associated with user email addresses to determine which users are eligible to sign in via SSO. Multiple domains can be configured for organizations using different email domains.

Supabase SSO prohibited public domains

Public domains like gmail.com and yahoo.com are not permitted for SSO configuration.

Supabase SSO auto-join behavior

When auto-join is enabled, SSO-authenticated users are automatically added to the organization on every sign-in, not only on first signup. This makes it safe to test SSO before enabling the feature.

Supabase SSO auto-join default role recommendation

The recommended default role for SSO auto-join is Developer, following the principle of least privilege. Users should be promoted individually as needed.

Supabase SSO configuration save behavior

When clicking Save changes in SSO configuration, the new SSO configuration is applied immediately. Any user with an email address matching one of the configured domains will be routed through the SSO flow when visiting the organization's sign-in URL.

Supabase SSO testing recommendation

Before rolling out SSO to an organization, thorough testing is strongly recommended with auto-join disabled initially to test the SSO configuration before enabling it.

Google Workspace SSO G Suite preset

A G Suite preset is available in Supabase SSO attribute mapping configuration that can be used to automatically populate attribute mappings if custom settings were not configured.

Google Workspace SSO metadata download location

In Google Workspace SAML app configuration, download IdP metadata from the Google Identity Provider details screen. This metadata file must be uploaded to Supabase SSO settings.

Configure social auth providers on self-hosted instance

Social auth providers (Apple, Google, GitHub, etc.) need to be configured in your self-hosted .env file by setting relevant GOTRUE_EXTERNAL_* variables. Redirect URLs in your OAuth provider consoles (Apple Developer, Google Cloud Console, etc.) must be updated to point to your self-hosted hostname instead of *.supabase.co.

Supported SSO providers and protocols

Supabase supports practically all identity providers that support the SAML 2.0 SSO protocol. Commonly documented providers include Google Workspaces, Azure Active Directory, and Okta.

Give your agent this brain