SSO setup

Connects an identity provider step by step: Okta, Entra ID, Google Workspace, or any SAML or OIDC provider. Copy the values it needs, paste back a metadata URL or file (read in the browser before it is saved), and test a real sign-in. Only then can SSO be required, with named admins keeping a password so nobody is locked out.