app.identity_providers
TableRow level security on
An org's enterprise identity provider (Section 9): SAML 2.0 or OIDC sign-in through a Supabase Auth SSO provider, optional just-in-time joins with a default role, and optional SCIM 2.0 provisioning authenticated by a hashed bearer token. Needs the saml_sso feature; SCIM also needs scim.
Primary key: id
| Column | Type | Nullable | Description |
|---|---|---|---|
| id | uuid | No | Primary key, UUID v7. |
| org_id | uuid | No | Org the provider signs people into.References app.organizations.id |
| protocol | app.identity_protocol | No | SAML or OIDC. |
| name | text | No | Provider name, for example the IdP tenant. |
| auth_provider_id | text | No | Supabase Auth SSO provider id; a sign-in through it carries app_metadata.provider = sso:<id>. |
| default_role_id | uuid | No | Role a person receives on a just-in-time or SCIM join. Never the Owner role.References app.roles.id |
| jit_enabled | boolean | No | Whether signing in through the provider joins the org. |
| scim_enabled | boolean | No | Whether SCIM provisioning is on. |
| scim_token_hash | bytea | Yes | SHA-256 of the SCIM bearer token. The token is shown once. Never readable by signed-in callers. |
| scim_token_prefix | text | Yes | Visible start of the SCIM token, to tell tokens apart. |
| deleted_at | timestamp with time zone | Yes | Soft delete time. A row with deleted_at set is ignored by every access helper. |
| created_at | timestamp with time zone | No | When the row was inserted. Set by the database. |
| created_by | uuid | Yes | Person who inserted the row, or null for a platform process. Set by the database.References app.people.id |
| updated_at | timestamp with time zone | No | When the row last changed. Set by the database. |
| updated_by | uuid | Yes | Person who last changed the row, or null for a platform process. Set by the database.References app.people.id |