From 00a522f9d0b5a70bad095ed1b813515e942cd2e9 Mon Sep 17 00:00:00 2001
From: Carlos Monastyrski <charly.monastyrski@gmail.com>
Date: Thu, 4 Sep 2025 11:53:33 -0300
Subject: [PATCH] Fix Google SSO issue with SAML configs when SSO is enforced
 and not SAML

---
 frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx  | 6 +++++-
 .../components/OrgSsoTab/OrgGeneralAuthSection.tsx          | 5 +++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx b/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
index 9e6850f82..aeb38a182 100644
--- a/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
+++ b/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
@@ -92,7 +92,11 @@ export const SelectOrganizationSection = () => {
           url = `/api/v1/sso/oidc/login?orgSlug=${organization.slug}${
             callbackPort ? `&callbackPort=${callbackPort}` : ""
           }`;
-        } else if (organization.orgAuthMethod === AuthMethod.SAML) {
+        } else if (
+          organization.orgAuthMethod === AuthMethod.SAML &&
+          // if google sso is enforced, we don't want to redirect to saml
+          !organization.googleSsoAuthEnforced
+        ) {
           url = `/api/v1/sso/redirect/saml2/organizations/${organization.slug}`;
 
           if (callbackPort) {
diff --git a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
index 53df91974..e86f2fb9f 100644
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
@@ -204,9 +204,10 @@ export const OrgGeneralAuthSection = ({
             </OrgPermissionCan>
           </div>
           <p className="text-sm text-mineshaft-300">
-            Enforce users to authenticate via Google to access this organization.
+            Enforce users to authenticate via Google OAuth SSO to access this organization.
             <br />
-            When this is enabled your organization members will only be able to login with Google.
+            When this is enabled your organization members will only be able to login with Google
+            OAuth (not Google SAML).
           </p>
         </div>
       </div>