docs: SSO Self Service

[marksalpeter]

Motivation

• Reorganize the Enterprise SSO documentation so the SSO sign-in flow illustration and the note that Langfuse supports OIDC (not SAML) appear in the broader Enterprise SSO & SSO Enforcement context instead of inside the step-by-step Cloud setup flow.

Description

• Moved the <Frame> SSO sign-in image and the OIDC only <Callout> block from the end of the Cloud configuration steps into the Enterprise SSO overview area just after the details list.
• Kept the Cloud Verify Domain and Configure SSO steps intact and removed the general context from the procedural flow to improve scan-ability.
• Modified content/docs/administration/authentication-and-sso.mdx to reflect the new ordering.

Testing

• Ran pnpm exec prettier --check content/docs/administration/authentication-and-sso.mdx and the check passed.

---

Codex Task

Disclaimer: Experimental PR review

Greptile Summary

This PR reorganizes the Enterprise SSO documentation to surface the sign-in flow illustration and the OIDC-only callout earlier in the overview, and replaces the legacy "contact support" setup path with a self-service Cloud configuration flow covering DNS domain verification and SSO configuration.

• The Okta vendor guide is updated from "share credentials with Langfuse support" to a self-service domain-verify + configure flow, with steps renumbered accordingly.
• A new changelog entry announces the self-service feature and links to the updated documentation anchor.

Confidence Score: 3/5

The documentation reorganization is clean, but the Okta vendor guide now contains two conflicting redirect-URI instructions that could leave users with a misconfigured IdP allowlist.

The Okta guide's Step 2 still tells users to manually enter a hard-coded callback URL in Okta, while the new Step 5 tells them to copy a system-generated callback URL from Langfuse's UI and add it to the same allowlist. A user following the guide linearly will configure the redirect URI twice with possibly different values — the manually entered one from Step 2 may not match the UI-generated one, leaving SSO broken after setup.

content/docs/administration/authentication-and-sso.mdx — specifically the Okta vendor guide section where Step 2 (Configure the Application) and Step 5 (Configure SSO in Langfuse) both reference the Sign-in redirect URI.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User navigates to Org Settings > SSO] --> B[Add Domain]
    B --> C[Copy DNS TXT record to DNS provider]
    C --> D{DNS propagated?}
    D -- No --> E[Wait up to 24 hours]
    E --> D
    D -- Yes --> F[Click Verify in Langfuse]
    F --> G[Domain verified]
    G --> H[Click Configure SSO next to domain]
    H --> I[Copy callback URL from Langfuse UI]
    I --> J[Whitelist callback URL in IdP]
    J --> K[Enter Issuer URL, Client ID, Client Secret]
    K --> L[Save configuration]
    L --> M[Test sign-in with domain user]
    M --> N{Sign-in successful?}
    N -- Yes --> O[SSO configured ✓]
    N -- No --> P[Check issuer URL & callback allowlist]
    P --> K

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
content/docs/administration/authentication-and-sso.mdx:126-132
**Redirect URI configured twice with potentially different values**

Step 2 instructs users to hard-code the redirect URI (`https://<langfuse-url>/api/auth/callback/<domain>.okta`) manually in Okta before they have done the domain-verification flow. Step 5 then tells them to copy the callback URL from Langfuse's UI and add it to the same Okta allowlist. A user following these steps linearly will attempt to set the redirect URI twice, and the Step 2 format (which uses a user-supplied `<domain>` slug) may not match what Langfuse generates in the UI — leaving the correct Langfuse-generated URL absent from Okta's allowlist or leaving a stale, manually-entered URL that never resolves correctly.

_{Reviews (1): Last reviewed commit: "docs: move SSO signin and OIDC note abov..." | Re-trigger Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
langfuse-docs	Ready	Preview, Comment	May 8, 2026 3:01pm

[github-actions]

@claude review

[jannikmaierhoefer]

LGTM