We are adding Enterprise SSO to our SPA, and i am unsure how Enterprise SSO will affect our current invite flow. We do not have registration, you have to be invited by email. When someone invites another user we create an Ory identity for that user and send a recovery link on email. Is this approach still the way to go for SSO users? The recovery link will give them a session without requiring them to log in at the external login page, is this ok? Also, These users should not have to set a ory password. How can the sso id and the ory identity be linked without the user having to explicitly do the linking (i.e click link button etc)? Should I for instance redirect the user to the external login page when they access the recovery link, and then link the identities in the background when the user returns? Not sure what the recommended approach is, hopefully this has been solved before 🙂 Thanks for any advice!

I also had some questions about SSO when self-registration is disabled: https://ory-community.slack.com/archives/C02MR4DEEGH/p1724697900268399 I'm interested to see what the response is here

Seems our use cases are the same. The way i understand it now, If the linking needs to happen by entering their sso credentials, while also having a ory session in advance (to not be considered a new registration), doing it when they access a recovery link (not sure if you use that) could be an approach. But that relies on them completing the linking the first time they use that link, so its not going to be great (i.e they access the link, get a session, but then dont login with the external idp to complete the linking). The link is now expired, and the only way to recover is to receive a new recovery link by email. Have you tried something like that?

That does work. It does feel pretty janky though. Also, if the user doesn't set a password when they follow the recovery link, then when they try to login, they get this confusing page where there's no password entry box

We will also enable self-registration. My understanding is that its not possible to link an account without setting the password, so we will have to continue to support recovery for these users after sso is enabled for their domain. Since the recovery flow is disabled for domains connected to an organization, this will have to be through the admin api, which is a bit annoying. What are your thoughts on this?

Hmm yes, it's not ideal that on one hand Enterprise SSO accounts require a password but on the other hand some of their password functionality is disabled