From 00a522f9d0b5a70bad095ed1b813515e942cd2e9 Mon Sep 17 00:00:00 2001
From: Carlos Monastyrski <charly.monastyrski@gmail.com>
Date: Thu, 4 Sep 2025 11:53:33 -0300
Subject: [PATCH 1/3] Fix Google SSO issue with SAML configs when SSO is
 enforced and not SAML

---
 frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx  | 6 +++++-
 .../components/OrgSsoTab/OrgGeneralAuthSection.tsx          | 5 +++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx b/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
index 9e6850f82..aeb38a182 100644
--- a/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
+++ b/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
@@ -92,7 +92,11 @@ export const SelectOrganizationSection = () => {
           url = `/api/v1/sso/oidc/login?orgSlug=${organization.slug}${
             callbackPort ? `&callbackPort=${callbackPort}` : ""
           }`;
-        } else if (organization.orgAuthMethod === AuthMethod.SAML) {
+        } else if (
+          organization.orgAuthMethod === AuthMethod.SAML &&
+          // if google sso is enforced, we don't want to redirect to saml
+          !organization.googleSsoAuthEnforced
+        ) {
           url = `/api/v1/sso/redirect/saml2/organizations/${organization.slug}`;
 
           if (callbackPort) {
diff --git a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
index 53df91974..e86f2fb9f 100644
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
@@ -204,9 +204,10 @@ export const OrgGeneralAuthSection = ({
             </OrgPermissionCan>
           </div>
           <p className="text-sm text-mineshaft-300">
-            Enforce users to authenticate via Google to access this organization.
+            Enforce users to authenticate via Google OAuth SSO to access this organization.
             <br />
-            When this is enabled your organization members will only be able to login with Google.
+            When this is enabled your organization members will only be able to login with Google
+            OAuth (not Google SAML).
           </p>
         </div>
       </div>

From 8b84fc093fac468735327a71d17351d653ed5105 Mon Sep 17 00:00:00 2001
From: Carlos Monastyrski <charly.monastyrski@gmail.com>
Date: Thu, 4 Sep 2025 11:56:09 -0300
Subject: [PATCH 2/3] Improve description of Google SSO enforcement

---
 .../SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
index e86f2fb9f..b9ca11748 100644
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
@@ -207,7 +207,7 @@ export const OrgGeneralAuthSection = ({
             Enforce users to authenticate via Google OAuth SSO to access this organization.
             <br />
             When this is enabled your organization members will only be able to login with Google
-            OAuth (not Google SAML).
+            SSO (not Google SAML).
           </p>
         </div>
       </div>

From 6c2ea938225179abefad0801a7d8500090d5c09a Mon Sep 17 00:00:00 2001
From: Carlos Monastyrski <charly.monastyrski@gmail.com>
Date: Thu, 4 Sep 2025 17:43:40 -0300
Subject: [PATCH 3/3] Improve handleSelectOrganization logic for SSO
 enforcement

---
 .../auth/SelectOrgPage/SelectOrgSection.tsx   | 25 ++++++++-----------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx b/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
index aeb38a182..4dd0bbe24 100644
--- a/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
+++ b/frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
@@ -88,29 +88,24 @@ export const SelectOrganizationSection = () => {
         // org has an org-level auth method enabled (e.g. SAML)
         // -> logout + redirect to SAML SSO
         let url = "";
-        if (organization.orgAuthMethod === AuthMethod.OIDC) {
+        if (organization.googleSsoAuthEnforced) {
+          if (authToken.authMethod !== AuthMethod.GOOGLE) {
+            url = `/api/v1/sso/redirect/google?org_slug=${organization.slug}`;
+
+            if (callbackPort) {
+              url += `&callback_port=${callbackPort}`;
+            }
+          }
+        } else if (organization.orgAuthMethod === AuthMethod.OIDC) {
           url = `/api/v1/sso/oidc/login?orgSlug=${organization.slug}${
             callbackPort ? `&callbackPort=${callbackPort}` : ""
           }`;
-        } else if (
-          organization.orgAuthMethod === AuthMethod.SAML &&
-          // if google sso is enforced, we don't want to redirect to saml
-          !organization.googleSsoAuthEnforced
-        ) {
+        } else if (organization.orgAuthMethod === AuthMethod.SAML) {
           url = `/api/v1/sso/redirect/saml2/organizations/${organization.slug}`;
 
           if (callbackPort) {
             url += `?callback_port=${callbackPort}`;
           }
-        } else if (
-          organization.googleSsoAuthEnforced &&
-          authToken.authMethod !== AuthMethod.GOOGLE
-        ) {
-          url = `/api/v1/sso/redirect/google?org_slug=${organization.slug}`;
-
-          if (callbackPort) {
-            url += `&callback_port=${callbackPort}`;
-          }
         }
 
         // we are conditionally checking if the url is set because it may not be set if google SSO is enforced, but the user is already logged in with google SSO