Summary

Lets a self-host operator configure one OIDC identity provider (Google, Okta, Entra, any discovery-document IdP) as a sign-in method, with a verified email-domain allowlist acting as the invite: admitted users auto-join the instance org as member; everyone else is rejected. Email/password signup stays invite-gated; nothing becomes open registration.

Configuration:

EXECUTOR_SSO_PROVIDER_ID=google        # also the OAuth callback path segment
EXECUTOR_SSO_CLIENT_ID=...
EXECUTOR_SSO_CLIENT_SECRET=...
EXECUTOR_SSO_ALLOWED_DOMAINS=example.com
EXECUTOR_SSO_DISCOVERY_URL=...         # optional; preset for providerId=google
EXECUTOR_SSO_PROVIDER_NAME=...         # optional login-button label