v2.2.0 — SSO login via Microsoft Entra ID and Google

SSO login via Microsoft Entra ID and Google

Automator now supports Single Sign-On as an additional login method — username/password
login is unchanged and still fully supported. Everything is configured from Settings →
Single Sign-On; no .env changes or redeploys required.

Why

Rolling Automator out to a team usually means plugging into whatever identity provider
the organization already uses, rather than managing a separate set of local credentials.
Entra ID (Azure AD) and Google cover the two most common cases.

What's new

• Settings → Single Sign-On tab: per-provider enable toggle, Client ID/Secret,
  Tenant ID (Entra), and an optional comma-separated allowed-email-domains restriction.
  Secrets are encrypted at rest and write-only in the UI, the same as the existing
  Anthropic API key field.
• Admin-configurable account provisioning policy — choose whether a first-time SSO
  login automatically creates a new account (with a configurable default role), or is
  rejected until an admin has already created a matching-email account in Settings →
  Users.
• Automatic account linking — if an admin already created an account with a matching
  email, the first SSO login for that email links it automatically; no manual linking
  step.
• Accounts created via auto-provisioning have no local password (they can only sign in
  via SSO) — the My Account page now shows a clear message instead of a broken password
  form for those accounts.
• New docs/SSO.md walks through Entra ID app registration and Google Cloud OAuth client
  setup end to end, including the exact redirect URIs to register.

Upgrading

Migrations add nullable entra_object_id/google_id columns to users (existing
accounts are unaffected) and new SSO settings columns to app_settings, all off by
default — SSO is inert until an admin enables a provider in Settings. Run
php artisan migrate --force as usual.