docs: document RBAC support for SSO authentication#6318
Conversation
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| @@ -0,0 +1,9 @@ | |||
| ## SSO now supports role-based access control | |||
There was a problem hiding this comment.
📝 [vale] reported by reviewdog 🐶
[FernStyles.Headings] 'SSO now supports role-based access control' should use sentence-style capitalization.
|
🌿 Preview your docs: https://fern-preview-devin-1784559900-sso-rbac-docs.docs.buildwithfern.com/learn Here are the markdown pages you've updated: |
|
|
||
| SSO can gate content by role. Fern reads each user's roles from the token your identity provider issues, then applies the [`roles`](/learn/docs/authentication/features/rbac#setup) and [`viewers`](/learn/docs/authentication/features/rbac#in-navigation) rules in your `docs.yml`. | ||
|
|
||
| The identity provider must include the user's roles on the token. Enable organization roles in your provider, then either assign roles to users directly or map your SSO/directory groups to those roles. Fern uses the organization role by default; to read roles from a custom token claim instead, tell Fern which claim to parse. |
There was a problem hiding this comment.
can you provide details on how to do this
There was a problem hiding this comment.
Added a concrete <Steps> walkthrough (38b9914): enable Organization Roles in WorkOS → assign roles directly or via SSO/directory-group mapping (SCIM) → declare the same slugs in docs.yml. Also noted the default org-role behavior and the custom-claim option. Let me know if you'd like the WorkOS dashboard click-paths spelled out too.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2 participants
Summary
Documents the new capability from fern-platform#13195: the native WorkOS SSO flow now carries the user's roles into the
fern_token, so SSO can be used with RBAC (viewers:/<If roles={...}>). Previously RBAC was limited to JWT and OAuth.Changes across the authentication docs:
sso.mdx— corrected the callout that claimed SSO "doesn't support role management" (now: SSO supports RBAC but not API key injection), and added a Role-based access control section explaining that Fern reads roles from the identity provider's token, and the customer must populate roles (org roles or SSO/directory group mapping).rbac.mdx— added SSO alongside password/JWT/OAuth in the supported-methods sentence, the setup step, and the Enterprise-plan callout.overview.mdx— the SSO bullet in "Which option should I use?" now notes RBAC support.changelog/2026-07-20.mdx— newsecurity-tagged entry.Framed for docs users (SSO setup is Fern-managed), not the WorkOS
roles_claimconfig internals.Link to Devin session: https://app.devin.ai/sessions/56cdeaf6d474438895bd7e063d224a9e