Docs

Shared tenant Social SSO — 14 October 2026 ​

Verified gap and native fix ​

The existing Social issuer read one installation-global OIDC configuration. AdiSaan/AIOHM share one installation; OHM/Blanka share another. Reuse that issuer and the existing encrypted Setting store for per-tenant credentials. social_sso_{tenant_id} contains enabled, issuer, client_id, encrypted client_secret and redirect_uri. Settings apply only when tenant context exists and the stored issuer exactly matches the request host. The installation's private signing-key path cannot be overridden. Resolution is request-local; global configuration is never mutated. Existing primary issuers keep their installation configuration.

Identity credentials stay on their own installation. Licence authority remains in AIOHM's central SocialPartnerLicense registry on 109.199.122.125; the native Social callback checks active licence, issuer, tenant subject, owner and workspace. Client installations need no duplicate licence table or licensing API. Social's existing provisioner creates isolated providers/workspaces and administrator- covered agency entitlements, without external billing.

Rollout ​

  • Back up the native issuer, provision through aiohm-partner-provision, and keep tenant client secrets encrypted. Transport bootstrap secrets privately and remove temporary plaintext copies after provisioning.
  • Set the exact callback returned by the Social provider: https://social.aiohm.org/api/v1/auth/oidc/{provider_id}/callback.
  • Deploy this controller to the authorized installation. Older clients also receive the canonical single-use underlying authorization-code-store fix; preserve existing global issuer and signing key.
  • Where Nginx denies dot paths, add an exact FastCGI exception only for /social-sso/.well-known/openid-configuration. Do not relax all dot-file rules.
  • Verify public discovery, email provider selection, PKCE token exchange and userinfo. These protocol checks do not establish a browser password login.

Completed scope ​

AdiSaan: admin.adisaan.com on 109.199.122.125, owner 265, [email protected]. OHM: admin.ohm.events on 167.86.69.100, existing owner 1, [email protected]. Both central licences and native agency plans active. Blanka's owner remains 35 / [email protected]; its stale licence discovery email was corrected without replacing its owner, workspace or global issuer. AdiSaan's local DEV owner 120 also uses [email protected]. Passwords preserved.

Validation: 7 native issuer tests / 21 assertions, including tenant encryption, exact-host rejection, global config preservation, code reuse prevention and wrong-client rejection. Live public discovery and real PKCE token/userinfo exchanges succeeded for AdiSaan and OHM. Blanka discovery remains unchanged. No channels were moved and no posts were published. No stable release or network-wide automatic update was published.