docs: add Enterprise SSO guide for SSO administrators

[sea-snake]

Internet Identity can authenticate an organization's staff against its own OpenID provider, but nothing in the docs described how to set that up. Adds a guide for the SSO administrator, and the application developer's half to the existing Internet Identity page.

New page: Single sign-on

docs/guides/authentication/single-sign-on.md, order: 2, so it sits directly after Internet Identity in the Authentication group (Verifiable credentials moves to order: 3).

Follows an existing internal one-pager, and stays at that level of detail:

• Switch on SSO for the organization (required, one time): register an OIDC client, then publish /.well-known/ii-openid-configuration on the company domain.
• Control access per application (optional, per app): a second client, the provider-side assignment that acts as the access rule, and one app_clients line.
• The complete file, with the per-app fields, hiding an app name behind a salted hash, and gate_all_apps.

Internet Identity page

Adds ### One-click SSO sign-in after the existing OpenID section (ssoDomain, mutual exclusivity with openIdProvider, and isValidSsoDomain with its abort and timing behaviour), a #### SSO-scoped attributes subsection, and a Next steps link to the new page.

Verification

The field names, the app_clients key forms, and the gate_all_apps behaviour are checked against the Internet Identity implementation. internet-identity is not among the .sources/ submodules, so the page cites the upstream path it tracks in a trailing comment.

The identity-provider-specific setting (the Entra ID note) cannot be verified from ICP sources and carries a Needs human verification comment.

npm run build passes, and both pages render.

🤖 Generated with Claude Code

[github-actions]

🤖 Here's your preview: https://z4vwg-raaaa-aaaam-aiiga-cai.icp0.io

[Copilot]

Pull request overview

Adds administrator-facing documentation for configuring Internet Identity single sign-on (SSO) via an organization’s OpenID Connect provider, and updates the existing Internet Identity guide with the corresponding application-side integration details. Also adjusts sidebar ordering so the new guide sits next to the existing authentication docs.

Changes:

• Added a new SSO guide covering OIDC client setup, the /.well-known/ii-openid-configuration discovery file, per-app access control, and troubleshooting.
• Updated the Internet Identity guide with ssoDomain usage, isValidSsoDomain, and SSO-scoped attribute key examples.
• Moved “Verifiable credentials” down one slot in the Authentication sidebar order.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
docs/guides/authentication/verifiable-credentials.md	Updates sidebar ordering to make room for the new SSO guide.
docs/guides/authentication/single-sign-on.md	New administrator-focused SSO setup guide (OIDC client + discovery file + optional per-app access control).
docs/guides/authentication/internet-identity.mdx	Adds application-side “one-click SSO sign-in” and SSO-scoped attribute documentation, plus Next steps link.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (4)

docs/guides/authentication/internet-identity.mdx:161

• The docs assert a precise timing guarantee ("never resolves in under 750 ms"). That kind of implementation detail is brittle and can become incorrect across SDK versions. Consider describing the behavior without hard-coding a minimum duration.

Call `controller.abort()` when the input changes. An aborted check rejects instead of returning `false`, so a superseded check is never read as an invalid domain. The check also never resolves in under 750 ms, which keeps a partially typed domain from flashing an error on every keystroke.

docs/guides/authentication/single-sign-on.md:22

• The navigation path "Create App Integration → OIDC → Web Application" is Okta-specific UI wording, but the guide is written as if it applies to any IdP. Consider making the instruction generic and optionally calling out Okta as an example so Entra/other IdPs aren’t misled.

Create App Integration → **OIDC** → **Web Application**.

docs/guides/authentication/internet-identity.mdx:134

• This sentence says nothing has to be registered on either side, but the SSO flow still requires the organization to register an OIDC client in its IdP. Reword to avoid contradicting the new SSO admin guide and to clarify that it’s the application that does not need a client registration with the org’s IdP.

To send the user to their organization's own OpenID provider instead, pass `ssoDomain` with the organization's domain. Internet Identity resolves the provider from a configuration file the organization publishes on that domain, so nothing has to be registered on either side:

docs/guides/authentication/internet-identity.mdx:148

• This snippet creates a new AuthClient, but only imports isValidSsoDomain. Readers copying the snippet will hit a missing import for AuthClient; either include it here or remove the import line entirely.

import { isValidSsoDomain } from "@icp-sdk/auth/client";