Portal v0.43.0 — SSO and directory access, end to end

v0.43.0 makes directory-granted access follow the exact SCIM group resource from provisioning through rename and deletion, and brings every supported provider guide up to current screens.

SSO and directory sync

• Role and runner-access mappings now bind to emisar's immutable directory-group ID. External IDs remain optional provider correlation data, same-name groups stay distinct, rename preserves grants, and delete/recreate never inherits old access.
• Okta groups without an external ID can be mapped directly. Okta and Microsoft Entra ID OIDC convergence accepts only the exact active SCIM identity under the provider's configured identifier claim; an explicit unverified email claim remains denied.
• The Okta, Entra, JumpCloud, Google Workspace, and Keycloak guides now match current provider screens and state exactly which OIDC and SCIM paths were live-tested.

Console and email

• Pending access requests stay compact until a decision needs runner choices or an existing-account warning. Team controls stack cleanly on smaller screens, and SSO connection details read as one stable record.
• Approval override asks for the audited reason once and clearly states which approval count is being bypassed and which policy and runner checks still apply.
• Transactional emails put the next action first, link the account context when it exists, express approval state in words as well as color, and keep HTML and plain text aligned.

Upgrade note

This release includes a one-way authorization-mapping migration. Use a controlled no-overlap cutover: stop SSO/SCIM and mapping writes, drain every v0.42 Portal node, migrate once, start only the v0.43 image, verify directory authorization, and then reopen traffic. After the migration commits, v0.42 is not a rollback candidate and the migration must not be run down; rollback may use only an image that understands immutable directory-group mappings.