Open Shadow AI v0.2.0 — SSO & SCIM preview

Open Shadow AI 0.2.0 — console identity preview

Optional console sign-in and provisioning for one organization per deployment:

• OIDC authorization-code sign-in with PKCE S256 and previously provisioned users. The verified issuer and stable identity claim must match SCIM externalId; email never links accounts.
• A documented SCIM 2.0 Users/Groups subset, role mapping by group external ID and session revocation when provisioning changes arrive. Reactivation requires fresh authentication.
• Optional Docker Compose and Kubernetes identity overlays, an Entra setup guide and retained local administrator recovery access. Base deployments keep OIDC/SCIM disabled.
• Bundled proxy logging omits query strings and disables callback error logs to protect authorization codes.

Before upgrading, back up data, configuration and keys; stop application writes and apply PostgreSQL migration 003 before starting the new API/workers. Review username-collision checks and the guarded downgrade in the upgrade procedure. Keep and test a separate local recovery administrator before enabling SSO.

Follow the identity setup guide and supported subset and review the validation evidence and boundaries. Live Entra sign-in/provisioning, other providers and Kubernetes require acceptance testing in your environment. This preview does not include SAML, multi-organization isolation or identity-provider certification.

Validation: all five jobs passed in CI run 36280261065 for source 00e98d6539ac37c7f98d12f3c53d77be8a1f365d: 203 tests per Python version, 32 frontend tests, two real-store integration tests and both HTTP smoke checks. OIDC sign-in uses a signed mock provider; the SCIM smoke uses real disposable stores. This is a prerelease, with live-tenant acceptance still required.