misc: allow org admins to bypass sso enforcement

frontend/src/helpers/roles.ts

@@ -1,6 +1,6 @@
 import { ProjectMembershipRole, TOrgRole } from "@app/hooks/api/roles/types";
 
-enum OrgMembershipRole {
+export enum OrgMembershipRole {
   Admin = "admin",
   Member = "member",
   NoAccess = "no-access"

frontend/src/hooks/api/organization/types.ts

@@ -17,6 +17,7 @@ export type Organization = {
   selectedMfaMethod?: MfaMethod;
   shouldUseNewPrivilegeSystem: boolean;
   allowSecretSharingOutsideOrganization?: boolean;
+  userRole: string;
 };
 
 export type UpdateOrgDTO = {

frontend/src/pages/auth/LoginPage/components/InitialStep/InitialStep.tsx

@@ -34,6 +34,7 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
   const { t } = useTranslation();
   const [isLoading, setIsLoading] = useState(false);
   const [loginError, setLoginError] = useState(false);
+  const [isOtherLoginMethodsSelected, setIsOtherLoginMethodsSelected] = useState(false);
   const { config } = useServerConfig();
   const queryParams = new URLSearchParams(window.location.search);
   const [captchaToken, setCaptchaToken] = useState("");
@@ -160,7 +161,11 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
     setIsLoading(false);
   };
 
-  if (config.defaultAuthOrgAuthEnforced && config.defaultAuthOrgAuthMethod) {
+  if (
+    config.defaultAuthOrgAuthEnforced &&
+    config.defaultAuthOrgAuthMethod &&
+    !isOtherLoginMethodsSelected
+  ) {
     return (
       <form
         onSubmit={handleLogin}
@@ -196,6 +201,14 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
             </Button>
           </div>
         )}
+        <Button
+          colorSchema="gray"
+          variant="link"
+          className="mt-6 font-normal text-mineshaft-400 transition-all duration-75 hover:text-mineshaft-300"
+          onClick={() => setIsOtherLoginMethodsSelected(true)}
+        >
+          Continue with other login methods
+        </Button>
       </form>
     );
   }

frontend/src/pages/auth/SelectOrgPage/SelectOrgPage.tsx

@@ -14,6 +14,7 @@ import { IsCliLoginSuccessful } from "@app/components/utilities/attemptCliLogin"
 import SecurityClient from "@app/components/utilities/SecurityClient";
 import { Button, Spinner } from "@app/components/v2";
 import { SessionStorageKeys } from "@app/const";
+import { OrgMembershipRole } from "@app/helpers/roles";
 import { useToggle } from "@app/hooks";
 import {
   useGetOrganizations,
@@ -68,7 +69,7 @@ export const SelectOrganizationPage = () => {
 
   const handleSelectOrganization = useCallback(
     async (organization: Organization) => {
-      if (organization.authEnforced) {
+      if (organization.authEnforced && organization.userRole !== OrgMembershipRole.Admin) {
         // org has an org-level auth method enabled (e.g. SAML)
         // -> logout + redirect to SAML SSO
         await logout.mutateAsync();

frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/OrgGeneralAuthSection.tsx

@@ -85,7 +85,7 @@ export const OrgGeneralAuthSection = () => {
           </OrgPermissionCan>
         </div>
         <p className="text-sm text-mineshaft-300">
-          Enforce members to authenticate via SAML to access this organization
+          Enforce non-admin users to authenticate via SAML to access this organization
         </p>
       </div>
       <UpgradePlanModal

frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/OrgOIDCSection.tsx

@@ -171,7 +171,7 @@ export const OrgOIDCSection = (): JSX.Element => {
           </OrgPermissionCan>
         </div>
         <p className="text-sm text-mineshaft-300">
-          Enforce members to authenticate via OIDC to access this organization
+          Enforce non-admin users to authenticate via OIDC to access this organization.
         </p>
       </div>
       <div className="py-4">