LUM-142 · Lumina PM

LUM-142 BlockedIdentityBackendSecurity

Issue brief

Context and approach

Rich text

Saved

Implement the end-to-end SSO callback flow for configured enterprise domains. The path must support OIDC and SAML providers, preserve PKCE state through redirects, and link verified identities to an existing Lumina account.

The rollout should be safe to stage by workspace. Authentication failures need actionable audit events so Support and Security can diagnose a rejected assertion without exposing sensitive provider payloads.

Click to edit

Current blocker

The sanitized authentication error taxonomy needs Security review before this can move to rollout.

Engineering note server/auth/sso/callback.ts

Keep provider-specific claims behind the identity adapter. The callback should return one normalized profile and one typed failure result.

server/auth/sso/callback.ts

Work breakdown

Subtasks

2/5 complete40%

LUM-142-01Configured OIDC and SAML providers can initiate sign-in Done

LUM-142-02PKCE state is validated and cleared after the callback Done

LUM-142-03Rejected assertions create a sanitized audit event In progress

LUM-142-04Integration tests cover first login and account linking Planned

LUM-142-05Workspace rollout and rollback steps are documented Planned

Collaboration

Activity

3 updates

MA
Mike Andrew moved this issue to In progress
Today, 09:42
JD
Jordan Diaz linked the identity adapter proposal
The adapter contract is ready for implementation.
Yesterday, 16:18
AW
Avery Wong raised a rollout blocker
We still need a sanitized error taxonomy for Support.
Yesterday, 11:06