From 5b6518b4f403914defb4512857eec68469977418 Mon Sep 17 00:00:00 2001 From: Vittorio Esposito Date: Wed, 22 Jul 2026 09:32:08 +0200 Subject: [PATCH] docs: document non-session SSO providers hidden from login --- content/configuration/auth-sso.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/configuration/auth-sso.md b/content/configuration/auth-sso.md index 96b211a7..7af7f8a9 100644 --- a/content/configuration/auth-sso.md +++ b/content/configuration/auth-sso.md @@ -23,6 +23,13 @@ For each of the auth providers listed, you must provide the following configurat | `AUTH__DRIVER` | Which driver to use, either `local`, `oauth2`, `openid`, `ldap`, `saml`. | | | `AUTH__MODE` | Whether to use `'cookie'` or `'session'` authentication mode when redirecting. Applies to the following drivers `oauth2`, `openid`, `saml`. | `session` | +::callout{icon="i-lucide-info"} +**Data Studio login** +The Data Studio login page only lists SSO providers configured with `AUTH__MODE=session` (the default). Providers using `cookie` mode are hidden from the login screen and filtered out of the `/auth` provider list, because they are intended for external applications that consume refresh tokens rather than the Data Studio session cookie. + +The `/auth/login/` flow still works for `cookie` mode providers. If an SSO button is missing from the login page, confirm the provider is set to `session` mode. +:: + ::callout{icon="i-lucide-info"} Cookie and session configuration settings such as `REFRESH_TOKEN_COOKIE_*`, `SESSION_COOKIE_*`, and related security parameters can be found in [Security & Limits](/configuration/security-limits). ::