docs: ask for the IdP metadata URL instead of four values - #635
Merged
Conversation
easymac
approved these changes
Aug 28, 2026
Admin can now import a SAML connection straight from an IdP metadata document, so the ask to the customer is a metadata URL plus their email domain. The three IdP values stay on the page as the fallback for providers like Google Workspace that only offer metadata as a download. Certificate rotation is now a re-read of the same metadata rather than a fresh certificate by email.
eseidel
force-pushed
the
docs/saml-metadata-url
branch
from
August 28, 2026 22:05
db40614 to
92f03bc
Compare
eseidel
enabled auto-merge (squash)
August 28, 2026 22:06
eseidel
added a commit
that referenced
this pull request
Aug 29, 2026
The metadata-URL change in #635 left a few spots still framed around the old "send us four values" ask: - The intro and the multi-domain bullet still said "the values". - The note about members with existing Google/Microsoft accounts had ended up inside the no-metadata-URL subsection, so it read as applying only to that path. It applies to everyone; moved it back up. - Okta step 6 still led with "View SAML setup instructions" rather than the metadata link. - Certificate rotation said Shorebird re-reads your metadata, which is not true for a connection created from hand-entered values. Also documents that Shorebird keeps every signing certificate the metadata lists, so publishing the new certificate alongside the old one makes a rotation a non-event, and labels the fallback table's Okta column as an example, since that section is aimed at providers that publish no metadata URL.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #633, and the docs half of a matching admin change.
Admin can now import a SAML connection straight from an IdP metadata document, so the ask to the customer drops from four values to two: a metadata URL and their email domain. This rewrites "What to send Shorebird" around that.
IdPto the Vale sentence-case heading exceptions, for the new heading.The admin-side change (metadata fetch + parse, "Import from metadata" dialog) is a separate PR in
_shorebird. This page is accurate either way — the metadata URL is already what the merged version recommends as the shortcut — so it doesn't need to land in lockstep.Context: McAfee's identity engineer asked for exactly this doc yesterday, and Josh has already sent them the link, so the sooner the ask is two things instead of four, the better.
npm run buildpasses with all internal links valid.