Merge pull request #3652 from Infisical/ENG-2817

Update docs and some UI to make Admin SSO bypass more clear

docs/documentation/platform/sso/auth0-oidc.mdx

@@ -70,7 +70,7 @@ description: "Learn how to configure Auth0 OIDC for Infisical SSO."
          prior to enforcing OIDC SSO to prevent any unintended issues.
       </Warning>
       <Info>
-         In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
+         In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
       </Info>
    </Step>
 </Steps>

docs/documentation/platform/sso/auth0-saml.mdx

@@ -76,7 +76,7 @@ description: "Learn how to configure Auth0 SAML for Infisical SSO."
         Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
 
         <Info>
-            In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
+            In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
         </Info>
     </Step>
 

docs/documentation/platform/sso/azure.mdx

@@ -109,7 +109,7 @@ description: "Learn how to configure Microsoft Entra ID for Infisical SSO."
          prior to enforcing SAML SSO to prevent any unintended issues.
       </Warning>
       <Info>
-         In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
+         In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
       </Info>
    </Step>
 </Steps>

docs/documentation/platform/sso/general-oidc/overview.mdx

@@ -70,7 +70,7 @@ Prerequisites:
          We recommend ensuring that your account is provisioned using the identity provider prior to enforcing OIDC SSO to prevent any unintended issues.
       </Warning>
       <Info>
-         In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
+         In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
       </Info>
     </Step>
 

docs/documentation/platform/sso/google-saml.mdx

@@ -84,7 +84,7 @@ description: "Learn how to configure Google SAML for Infisical SSO."
             prior to enforcing SAML SSO to prevent any unintended issues.
         </Warning>
         <Info>
-            In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
+            In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
         </Info>
     </Step>
 

docs/documentation/platform/sso/jumpcloud.mdx

@@ -85,11 +85,10 @@ description: "Learn how to configure JumpCloud SAML for Infisical SSO."
       Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
 
       <Warning>
-         We recommend ensuring that your account is provisioned the application in JumpCloud
+         We recommend ensuring that your account is provisioned in the application in JumpCloud prior to enforcing SAML SSO to prevent any unintended issues.
-         prior to enforcing SAML SSO to prevent any unintended issues.
       </Warning>
       <Info>
-         In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
+         In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
       </Info>
    </Step>
 </Steps>

docs/documentation/platform/sso/keycloak-oidc/overview.mdx

@@ -97,7 +97,7 @@ description: "Learn how to configure Keycloak OIDC for Infisical SSO."
             prior to enforcing OIDC SSO to prevent any unintended issues.
         </Warning>
         <Info>
-            In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
+            In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
         </Info>
     </Step>
 </Steps>

docs/documentation/platform/sso/keycloak-saml.mdx

@@ -83,7 +83,7 @@ description: "Learn how to configure Keycloak SAML for Infisical SSO."
 
       ![SAML keycloak client mappers user property](../../../images/sso/keycloak/client-mappers-user-property.png)
 
-      Set the the **Name** field to **Username**, the **Property** field to **username**, and the **SAML Attribtue Name** to **username**.
+      Set the the **Name** field to **Username**, the **Property** field to **username**, and the **SAML Attribute Name** to **username**.
 
       ![SAML keycloak client mappers username](../../../images/sso/keycloak/client-mappers-username.png)
 
@@ -128,7 +128,7 @@ description: "Learn how to configure Keycloak SAML for Infisical SSO."
          prior to enforcing SAML SSO to prevent any unintended issues.
       </Warning>
       <Info>
-         In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
+         In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
       </Info>
    </Step>
 </Steps>

docs/documentation/platform/sso/okta.mdx

@@ -93,13 +93,12 @@ description: "Learn how to configure Okta SAML 2.0 for Infisical SSO."
       Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.
 
       <Warning>
-         We recommend ensuring that your account is provisioned the application in Okta
+         We recommend ensuring that your account is provisioned for the application in Okta prior to enforcing SAML SSO to prevent any unintended issues.
-         prior to enforcing SAML SSO to prevent any unintended issues.
       </Warning>
-      <Info>
-         In case of a lockout, an organization admin can use the admin login portal in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
-      </Info>
 
+      <Info>
+         In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
+      </Info>
    </Step>
 </Steps>
 

docs/documentation/platform/sso/overview.mdx

@@ -39,18 +39,30 @@ If your required identity provider is not shown in the list above, please reach
   For enhanced security, Infisical enforces PKCE (Proof Key for Code Exchange) with the OAuth 2.0-based SSO providers and OIDC. This provides additional protection against authorization code interception attacks and strengthens your authentication flow security.
 </Info>
 
+## SSO Break Glass
+
+In the event your SSO provider experiences downtime, and you need to access Infisical, Organization Admins can utilize the Admin Login Portal to bypass SSO enforcement.
+
+This portal is accessible at `/login/admin` (e.g., https://app.infisical.com/login/admin).
+
+<Note>
+    To bypass SSO for an organization, you must be an **Organization Admin** for that specific organization. This **Organization Admin** role is independent of **Server Admin** status. Being a **Server Admin** alone does not grant permission to use this bypass feature.
+</Note>
+
 ## FAQ
 
 <AccordionGroup>
-  <Accordion title="Why does Infisical require additional email verification for users connected via SAML?">
+    <Accordion title="Why does Infisical require additional email verification for users connected via SAML?">
-    By default, Infisical Cloud is configured to not trust emails from external
+        By default, Infisical Cloud is configured to not trust emails from external
-    identity providers to prevent any malicious account takeover attempts via
+        identity providers to prevent any malicious account takeover attempts via
-    email spoofing. Accordingly, Infisical creates a new user for anyone provisioned
+        email spoofing. Accordingly, Infisical creates a new user for anyone provisioned
-    through an external identity provider and requires an additional email
+        through an external identity provider and requires an additional email
-    verification step upon their first login.
+        verification step upon their first login.
 
-    If you're running a self-hosted instance of Infisical and would like it to trust emails from external identity providers,
+        If you're running a self-hosted instance of Infisical and would like it to trust emails from external identity providers,
-    you can configure this behavior in the Server Admin Console.
+        you can configure this behavior in the Server Admin Console.
-
+    </Accordion>
-  </Accordion>
+    <Accordion title="Why do I get redirected to SSO when trying to use the Admin Login Portal?">
+        You are likely being redirected because you do not have email authentication mode enabled, or you're not an **Organization Admin**. This portal requires **Organization Admin** status and direct credential login (email and password). **Server Admin** status alone is insufficient.
+    </Accordion>
 </AccordionGroup>

frontend/src/pages/organization/SsoPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx

@@ -129,7 +129,16 @@ export const OrgGeneralAuthSection = () => {
                       level.
                     </span>
                     <p className="mt-4">
-                      In case of a lockout, admins can use the admin login portal at{" "}
+                      In case of a lockout, admins can use the{" "}
+                      <a
+                        target="_blank"
+                        className="underline underline-offset-2 hover:text-mineshaft-300"
+                        href="https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal"
+                        rel="noreferrer"
+                      >
+                        Admin Login Portal
+                      </a>{" "}
+                      at{" "}
                       <a
                         target="_blank"
                         rel="noopener noreferrer"

frontend/src/pages/organization/SsoPage/components/OrgSsoTab/OrgOIDCSection.tsx

@@ -212,7 +212,16 @@ export const OrgOIDCSection = (): JSX.Element => {
                       level.
                     </span>
                     <p className="mt-4">
-                      In case of a lockout, admins can use the admin login portal at{" "}
+                      In case of a lockout, admins can use the{" "}
+                      <a
+                        target="_blank"
+                        className="underline underline-offset-2 hover:text-mineshaft-300"
+                        href="https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal"
+                        rel="noreferrer"
+                      >
+                        Admin Login Portal
+                      </a>{" "}
+                      at{" "}
                       <a
                         target="_blank"
                         rel="noopener noreferrer"