{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/granite-md/json-schema/granite-md-ssoconnection-schema.json",
  "title": "SSOConnection",
  "x-generated": "2026-11-10",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/granite-md-openapi.yaml#/components/schemas/SSOConnection",
  "type": "object",
  "required": [
    "protocol",
    "issuer",
    "jit_role",
    "enforced"
  ],
  "properties": {
    "protocol": {
      "type": "string",
      "enum": [
        "oidc",
        "saml"
      ]
    },
    "issuer": {
      "type": "string",
      "description": "The OpenID Connect issuer, or the SAML identity provider's entity ID."
    },
    "client_id": {
      "type": "string"
    },
    "saml": {
      "type": "object",
      "description": "Granite's service provider, to register with a SAML identity provider.",
      "required": [
        "entity_id",
        "acs_url",
        "metadata_url"
      ],
      "properties": {
        "entity_id": {
          "type": "string"
        },
        "acs_url": {
          "type": "string"
        },
        "metadata_url": {
          "type": "string"
        }
      }
    },
    "jit_role": {
      "type": "string",
      "enum": [
        "member",
        "guest"
      ],
      "description": "Not used (kept for older apps). Single sign-on admits members and people with an open email invitation, who get its role (others get 403 `sso_not_invited`)."
    },
    "enforced": {
      "type": "boolean"
    },
    "tested_at": {
      "type": "string",
      "format": "date-time",
      "description": "The last successful SSO sign-in."
    },
    "redirect_url": {
      "type": "string",
      "description": "OpenID Connect; register this redirect URI with the identity provider."
    }
  }
}