Function getExampleEnvVars

packages/db/scripts/register-sso-provider.ts:325–382

(
  providerType: 'oidc' | 'saml',
  provider?: string
)

}

function getExampleEnvVars(
  providerType: 'oidc' | 'saml',
  provider?: string
): Record<string, string> {
  const baseVars = {
    SSO_ENABLED: 'true',
    SSO_PROVIDER_TYPE: providerType,
    SSO_PROVIDER_ID: provider || (providerType === 'oidc' ? 'okta' : 'adfs'),
    SSO_DOMAIN: 'yourcompany.com',
    SSO_USER_EMAIL: 'admin@yourcompany.com',
  }

  if (providerType === 'oidc') {
    const examples: Record<string, Record<string, string>> = {
      okta: {
        ...baseVars,
        SSO_PROVIDER_ID: 'okta',
        SSO_ISSUER: 'https://dev-123456.okta.com/oauth2/default',
        SSO_OIDC_CLIENT_ID: '0oavhncxymgOpe06E697',
        SSO_OIDC_CLIENT_SECRET: 'your-client-secret',
        SSO_OIDC_SCOPES: 'openid,profile,email',
      },
      'azure-ad': {
        ...baseVars,
        SSO_PROVIDER_ID: 'azure-ad',
        SSO_ISSUER: 'https://login.microsoftonline.com/{tenant-id}/v2.0',
        SSO_OIDC_CLIENT_ID: 'your-application-id',
        SSO_OIDC_CLIENT_SECRET: 'your-client-secret',
        SSO_MAPPING_ID: 'oid',
      },
      generic: {
        ...baseVars,
        SSO_PROVIDER_ID: 'custom-oidc',
        SSO_ISSUER: 'https://idp.example.com',
        SSO_OIDC_CLIENT_ID: 'your-client-id',
        SSO_OIDC_CLIENT_SECRET: 'your-client-secret',
        SSO_OIDC_AUTHORIZATION_ENDPOINT: 'https://idp.example.com/auth',
        SSO_OIDC_TOKEN_ENDPOINT: 'https://idp.example.com/token',
        SSO_OIDC_USERINFO_ENDPOINT: 'https://idp.example.com/userinfo',
      },
    }
    return examples[provider || 'okta'] || examples.generic
  }

  return {
    ...baseVars,
    SSO_PROVIDER_ID: 'adfs',
    SSO_ISSUER: 'https://adfs.company.com',
    SSO_SAML_ENTRY_POINT: 'https://adfs.company.com/adfs/ls/',
    SSO_SAML_CERT:
      '-----BEGIN CERTIFICATE-----\nMIIDBjCCAe4CAQAwDQYJKoZIhvcNAQEFBQAwEjEQMA4GA1UEAwwHYWRmcy...\n-----END CERTIFICATE-----',
    SSO_SAML_AUDIENCE: 'https://yourapp.com',
    SSO_SAML_WANT_ASSERTIONS_SIGNED: 'true',
    SSO_MAPPING_ID: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier',
    SSO_MAPPING_EMAIL: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
    SSO_MAPPING_NAME: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name',
  }
}