dont set org mapping by default

messages/en-US.json

@@ -898,6 +898,7 @@
     "idpDisplayName": "A display name for this identity provider",
     "idpAutoProvisionUsers": "Auto Provision Users",
     "idpAutoProvisionUsersDescription": "When enabled, users will be automatically created in the system upon first login with the ability to map users to roles and organizations.",
+    "idpAutoProvisionConfigureAfterCreate": "You can configure auto provision settings once the identity provider is created.",
     "licenseBadge": "EE",
     "idpType": "Provider Type",
     "idpTypeDescription": "Select the type of identity provider you want to configure",
@@ -949,7 +950,7 @@
     "defaultMappingsRole": "Default Role Mapping",
     "defaultMappingsRoleDescription": "The result of this expression must return the role name as defined in the organization as a string.",
     "defaultMappingsOrg": "Default Organization Mapping",
-    "defaultMappingsOrgDescription": "When set, this expression must return the organization ID or true for the user to access that organization. When unset, defining an organization policy for that org is enough: the user is allowed in as long as a valid role mapping can be resolved for them within the organization.",
+    "defaultMappingsOrgDescription": "When set, this expression must return the organization ID or true for the user to access that organization. When unset, defining a role mapping is enough: the user is allowed in as long as a valid role mapping can be resolved for them within the organization.",
     "defaultMappingsSubmit": "Save Default Mappings",
     "orgPoliciesEdit": "Edit Organization Policy",
     "org": "Organization",
@@ -2026,7 +2027,7 @@
     },
     "internationaldomaindetected": "International Domain Detected",
     "willbestoredas": "Will be stored as:",
-    "roleMappingDescription": "Determine how roles are assigned to users when they sign in when Auto Provision is enabled.",
+    "roleMappingDescription": "Determine how roles are assigned to users when they sign in with this identity provider.",
     "selectRole": "Select a Role",
     "roleMappingExpression": "Expression",
     "selectRolePlaceholder": "Choose a role",
@@ -2899,5 +2900,22 @@
     "httpDestUpdatedSuccess": "Destination updated successfully",
     "httpDestCreatedSuccess": "Destination created successfully",
     "httpDestUpdateFailed": "Failed to update destination",
-    "httpDestCreateFailed": "Failed to create destination"
+    "httpDestCreateFailed": "Failed to create destination",
+    "idpAddActionCreateNew": "Create new identity provider",
+    "idpAddActionImportFromOrg": "Import from another organization",
+    "idpImportDialogTitle": "Import Identity Provider",
+    "idpImportDialogDescription": "Choose an identity provider from an organization where you are an admin. It will be linked to this organization.",
+    "idpImportSearchPlaceholder": "Search by organization or provider name...",
+    "idpImportEmpty": "No identity providers found.",
+    "idpImportedDescription": "Identity provider imported successfully.",
+    "idpDeleteGlobalQuestion": "Are you sure you want to permanently delete this identity provider?",
+    "idpDeleteGlobalDescription": "This will permanently delete the identity provider from all organizations it is associated with.",
+    "idpUnassociateTitle": "Unassociate Identity Provider",
+    "idpUnassociateQuestion": "Are you sure you want to unassociate this identity provider from this organization?",
+    "idpUnassociateDescription": "All users associated with this identity provider will be removed from this organization, but the identity provider will still continue to exist for other associated organizations.",
+    "idpUnassociateConfirm": "Confirm Unassociate Identity Provider",
+    "idpUnassociateWarning": "This cannot be undone for this organization.",
+    "idpUnassociatedDescription": "Identity provider unassociated from this organization successfully",
+    "idpUnassociateMenu": "Unassociate",
+    "idpDeleteAllOrgsMenu": "Delete"
 }

server/lib/traefik/TraefikConfigManager.ts

@@ -19,6 +19,7 @@ export class TraefikConfigManager {
     private timeoutId: NodeJS.Timeout | null = null;
     private lastCertificateFetch: Date | null = null;
     private lastKnownDomains = new Set<string>();
+    private pendingDeletion = new Map<string, number>(); // domain -> cycles remaining before delete
     private lastLocalCertificateState = new Map<
         string,
         {
@@ -1004,33 +1005,62 @@ export class TraefikConfigManager {
 
                 const dirName = dirent.name;
                 // Only delete if NO current domain is exactly the same or ends with `.${dirName}`
-                const shouldDelete = !Array.from(currentActiveDomains).some(
+                const isUnused = !Array.from(currentActiveDomains).some(
                     (domain) =>
                         domain === dirName || domain.endsWith(`.${dirName}`)
                 );
 
-                if (shouldDelete) {
-                    const domainDir = path.join(certsPath, dirName);
-                    logger.info(
-                        `Cleaning up unused certificate directory: ${dirName}`
-                    );
-                    fs.rmSync(domainDir, { recursive: true, force: true });
-
-                    // Remove from local state tracking
-                    this.lastLocalCertificateState.delete(dirName);
-
-                    // Remove from dynamic config
-                    const certFilePath = path.join(domainDir, "cert.pem");
-                    const keyFilePath = path.join(domainDir, "key.pem");
-                    const before = dynamicConfig.tls.certificates.length;
-                    dynamicConfig.tls.certificates =
-                        dynamicConfig.tls.certificates.filter(
-                            (entry: any) =>
-                                entry.certFile !== certFilePath &&
-                                entry.keyFile !== keyFilePath
+                if (!isUnused) {
+                    // Domain is still active — remove from pending deletion if it was queued
+                    if (this.pendingDeletion.has(dirName)) {
+                        logger.info(
+                            `Certificate ${dirName} is active again, cancelling pending deletion`
                         );
-                    if (dynamicConfig.tls.certificates.length !== before) {
-                        configChanged = true;
+                        this.pendingDeletion.delete(dirName);
+                    }
+                    continue;
+                }
+
+                // Domain is unused — add to pending deletion or decrement its counter
+                if (!this.pendingDeletion.has(dirName)) {
+                    const graceCycles = 3;
+                    logger.info(
+                        `Certificate ${dirName} is no longer in use. Will delete after ${graceCycles} more cycles.`
+                    );
+                    this.pendingDeletion.set(dirName, graceCycles);
+                } else {
+                    const remaining = this.pendingDeletion.get(dirName)! - 1;
+                    if (remaining > 0) {
+                        logger.info(
+                            `Certificate ${dirName} pending deletion: ${remaining} cycle(s) remaining`
+                        );
+                        this.pendingDeletion.set(dirName, remaining);
+                    } else {
+                        // Grace period expired — actually delete now
+                        this.pendingDeletion.delete(dirName);
+
+                        const domainDir = path.join(certsPath, dirName);
+                        logger.info(
+                            `Cleaning up unused certificate directory: ${dirName}`
+                        );
+                        fs.rmSync(domainDir, { recursive: true, force: true });
+
+                        // Remove from local state tracking
+                        this.lastLocalCertificateState.delete(dirName);
+
+                        // Remove from dynamic config
+                        const certFilePath = path.join(domainDir, "cert.pem");
+                        const keyFilePath = path.join(domainDir, "key.pem");
+                        const before = dynamicConfig.tls.certificates.length;
+                        dynamicConfig.tls.certificates =
+                            dynamicConfig.tls.certificates.filter(
+                                (entry: any) =>
+                                    entry.certFile !== certFilePath &&
+                                    entry.keyFile !== keyFilePath
+                            );
+                        if (dynamicConfig.tls.certificates.length !== before) {
+                            configChanged = true;
+                        }
                     }
                 }
             }

server/private/routers/external.ts

@@ -40,7 +40,9 @@ import {
     verifyRoleAccess,
     verifyUserAccess,
     verifyUserCanSetUserOrgRoles,
-    verifySiteProvisioningKeyAccess
+    verifySiteProvisioningKeyAccess,
+    verifyIsLoggedInUser,
+    verifyAdmin
 } from "@server/middlewares";
 import { ActionsEnum } from "@server/auth/actions";
 import {
@@ -87,6 +89,7 @@ authenticated.put(
     "/org/:orgId/idp/oidc",
     verifyValidLicense,
     verifyValidSubscription(tierMatrix.orgOidc),
+    orgIdp.requireOrgIdentityProviderMode,
     verifyOrgAccess,
     verifyLimits,
     verifyUserHasAction(ActionsEnum.createIdp),
@@ -94,10 +97,23 @@ authenticated.put(
     orgIdp.createOrgOidcIdp
 );
 
+authenticated.post(
+    "/org/:orgId/idp/:idpId/import",
+    verifyValidLicense,
+    verifyValidSubscription(tierMatrix.orgOidc),
+    orgIdp.requireOrgIdentityProviderMode,
+    verifyOrgAccess,
+    verifyLimits,
+    verifyAdmin,
+    logActionAudit(ActionsEnum.createIdp),
+    orgIdp.importOrgIdp
+);
+
 authenticated.post(
     "/org/:orgId/idp/:idpId/oidc",
     verifyValidLicense,
     verifyValidSubscription(tierMatrix.orgOidc),
+    orgIdp.requireOrgIdentityProviderMode,
     verifyOrgAccess,
     verifyIdpAccess,
     verifyLimits,
@@ -109,6 +125,7 @@ authenticated.post(
 authenticated.delete(
     "/org/:orgId/idp/:idpId",
     verifyValidLicense,
+    orgIdp.requireOrgIdentityProviderMode,
     verifyOrgAccess,
     verifyIdpAccess,
     verifyUserHasAction(ActionsEnum.deleteIdp),
@@ -116,6 +133,17 @@ authenticated.delete(
     orgIdp.deleteOrgIdp
 );
 
+authenticated.delete(
+    "/org/:orgId/idp/:idpId/association",
+    verifyValidLicense,
+    orgIdp.requireOrgIdentityProviderMode,
+    verifyOrgAccess,
+    verifyIdpAccess,
+    verifyUserHasAction(ActionsEnum.deleteIdp),
+    logActionAudit(ActionsEnum.deleteIdp),
+    orgIdp.unassociateOrgIdp
+);
+
 authenticated.get(
     "/org/:orgId/idp/:idpId",
     verifyValidLicense,
@@ -125,16 +153,14 @@ authenticated.get(
     orgIdp.getOrgIdp
 );
 
-authenticated.get(
-    "/org/:orgId/idp",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.listIdps),
-    orgIdp.listOrgIdps
-);
-
 authenticated.get("/org/:orgId/idp", orgIdp.listOrgIdps); // anyone can see this; it's just a list of idp names and ids
 
+authenticated.get(
+    "/user/:userId/admin-org-idps",
+    verifyIsLoggedInUser,
+    orgIdp.listUserAdminOrgIdps
+);
+
 authenticated.get(
     "/org/:orgId/certificate/:domainId/:domain",
     verifyValidLicense,

server/private/routers/orgIdp/createOrgOidcIdp.ts

@@ -27,7 +27,6 @@ import config from "@server/lib/config";
 import { CreateOrgIdpResponse } from "@server/routers/orgIdp/types";
 import { isSubscribed } from "#private/lib/isSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import privateConfig from "#private/lib/config";
 import { build } from "@server/build";
 
 const paramsSchema = z.strictObject({ orgId: z.string().nonempty() });
@@ -45,6 +44,7 @@ const bodySchema = z.strictObject({
     autoProvision: z.boolean().optional(),
     variant: z.enum(["oidc", "google", "azure"]).optional().default("oidc"),
     roleMapping: z.string().optional(),
+    orgMapping: z.string().nullish(),
     tags: z.string().optional()
 });
 
@@ -94,18 +94,6 @@ export async function createOrgOidcIdp(
             );
         }
 
-        if (
-            privateConfig.getRawPrivateConfig().app.identity_provider_mode !==
-            "org"
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Organization-specific IdP creation is not allowed in the current identity provider mode. Set app.identity_provider_mode to 'org' in the private configuration to enable this feature."
-                )
-            );
-        }
-
         const {
             clientId,
             clientSecret,
@@ -118,6 +106,7 @@ export async function createOrgOidcIdp(
             name,
             variant,
             roleMapping,
+            orgMapping: orgMappingBody,
             tags
         } = parsedBody.data;
 
@@ -169,7 +158,7 @@ export async function createOrgOidcIdp(
                 idpId: idpRes.idpId,
                 orgId: orgId,
                 roleMapping: roleMapping || null,
-                orgMapping: `'${orgId}'`
+                orgMapping: orgMappingBody
             });
         });
 

server/private/routers/orgIdp/deleteOrgIdp.ts

@@ -22,7 +22,6 @@ import { fromError } from "zod-validation-error";
 import { idp, idpOidcConfig, idpOrg } from "@server/db";
 import { eq } from "drizzle-orm";
 import { OpenAPITags, registry } from "@server/openApi";
-import privateConfig from "#private/lib/config";
 
 const paramsSchema = z
     .object({
@@ -60,18 +59,6 @@ export async function deleteOrgIdp(
 
         const { idpId } = parsedParams.data;
 
-        if (
-            privateConfig.getRawPrivateConfig().app.identity_provider_mode !==
-            "org"
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Organization-specific IdP creation is not allowed in the current identity provider mode. Set app.identity_provider_mode to 'org' in the private configuration to enable this feature."
-                )
-            );
-        }
-
         // Check if IDP exists
         const [existingIdp] = await db
             .select()

server/private/routers/orgIdp/importOrgIdp.ts

@@ -0,0 +1,212 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { idp, idpOrg, orgs, roles, userOrgs } from "@server/db";
+import { and, eq, inArray } from "drizzle-orm";
+import { CreateOrgIdpResponse } from "@server/routers/orgIdp/types";
+import { generateOidcRedirectUrl } from "@server/lib/idp/generateRedirectUrl";
+import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
+import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    idpId: z.coerce.number<number>().int().positive()
+});
+
+const bodySchema = z.strictObject({
+    sourceOrgId: z.string().nonempty()
+});
+
+async function userIsOrgAdmin(
+    userId: string,
+    orgId: string,
+    session: Request["session"]
+): Promise<boolean> {
+    const [userOrgRow] = await db
+        .select()
+        .from(userOrgs)
+        .where(and(eq(userOrgs.userId, userId), eq(userOrgs.orgId, orgId)))
+        .limit(1);
+
+    if (!userOrgRow) {
+        return false;
+    }
+
+    const policyCheck = await checkOrgAccessPolicy({
+        orgId,
+        userId,
+        session
+    });
+    if (!policyCheck.allowed || policyCheck.error) {
+        return false;
+    }
+
+    const roleIds = await getUserOrgRoleIds(userId, orgId);
+    if (roleIds.length === 0) {
+        return false;
+    }
+
+    const [adminRole] = await db
+        .select()
+        .from(roles)
+        .where(and(inArray(roles.roleId, roleIds), eq(roles.isAdmin, true)))
+        .limit(1);
+
+    return !!adminRole;
+}
+
+export async function importOrgIdp(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId: targetOrgId, idpId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { sourceOrgId } = parsedBody.data;
+
+        if (sourceOrgId === targetOrgId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Source and target organization must be different"
+                )
+            );
+        }
+
+        const userId = req.user!.userId;
+
+        const sourceLinked = await db
+            .select()
+            .from(idpOrg)
+            .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, sourceOrgId)))
+            .limit(1);
+
+        if (sourceLinked.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "IdP not found for the source organization"
+                )
+            );
+        }
+
+        const sourceAdmin = await userIsOrgAdmin(
+            userId,
+            sourceOrgId,
+            req.session
+        );
+        if (!sourceAdmin) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "You must be an organization admin in the source organization where this IdP is linked"
+                )
+            );
+        }
+
+        const [targetOrg] = await db
+            .select({ orgId: orgs.orgId })
+            .from(orgs)
+            .where(eq(orgs.orgId, targetOrgId))
+            .limit(1);
+
+        if (!targetOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "Target organization not found"
+                )
+            );
+        }
+
+        const [existingIdp] = await db
+            .select()
+            .from(idp)
+            .where(eq(idp.idpId, idpId))
+            .limit(1);
+
+        if (!existingIdp) {
+            return next(createHttpError(HttpCode.NOT_FOUND, "IdP not found"));
+        }
+
+        const alreadyTarget = await db
+            .select()
+            .from(idpOrg)
+            .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, targetOrgId)))
+            .limit(1);
+
+        if (alreadyTarget.length > 0) {
+            return next(
+                createHttpError(
+                    HttpCode.CONFLICT,
+                    "This IdP is already linked to the target organization"
+                )
+            );
+        }
+
+        await db.insert(idpOrg).values({
+            idpId,
+            orgId: targetOrgId,
+            roleMapping: null,
+            orgMapping: null
+        });
+
+        const redirectUrl = await generateOidcRedirectUrl(idpId, targetOrgId);
+
+        return response<CreateOrgIdpResponse>(res, {
+            data: {
+                idpId,
+                redirectUrl
+            },
+            success: true,
+            error: false,
+            message: "Org IdP imported successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/orgIdp/index.ts

@@ -12,7 +12,11 @@
  */
 
 export * from "./createOrgOidcIdp";
+export * from "./importOrgIdp";
 export * from "./getOrgIdp";
 export * from "./listOrgIdps";
+export * from "./listUserAdminOrgIdps";
 export * from "./updateOrgOidcIdp";
 export * from "./deleteOrgIdp";
+export * from "./unassociateOrgIdp";
+export * from "./requireOrgIdentityProviderMode";

server/private/routers/orgIdp/listUserAdminOrgIdps.ts

@@ -0,0 +1,160 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, idpOidcConfig } from "@server/db";
+import { idp, idpOrg, orgs, roles, userOrgRoles } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { and, eq, inArray, sql } from "drizzle-orm";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { ListUserAdminOrgIdpsResponse } from "@server/routers/orgIdp/types";
+
+const querySchema = z.strictObject({
+    limit: z
+        .string()
+        .optional()
+        .default("1000")
+        .transform(Number)
+        .pipe(z.int().nonnegative()),
+    offset: z
+        .string()
+        .optional()
+        .default("0")
+        .transform(Number)
+        .pipe(z.int().nonnegative())
+});
+
+const paramsSchema = z.strictObject({
+    userId: z.string().nonempty()
+});
+
+async function getOrgIdsWhereUserIsAdmin(userId: string): Promise<string[]> {
+    const rows = await db
+        .select({ orgId: userOrgRoles.orgId })
+        .from(userOrgRoles)
+        .innerJoin(roles, eq(userOrgRoles.roleId, roles.roleId))
+        .where(and(eq(userOrgRoles.userId, userId), eq(roles.isAdmin, true)));
+    return [...new Set(rows.map((r) => r.orgId))];
+}
+
+async function queryIdpsForOrgs(
+    orgIds: string[],
+    limit: number,
+    offset: number
+) {
+    return db
+        .select({
+            idpId: idp.idpId,
+            orgId: idpOrg.orgId,
+            orgName: orgs.name,
+            name: idp.name,
+            type: idp.type,
+            variant: idpOidcConfig.variant,
+            tags: idp.tags
+        })
+        .from(idpOrg)
+        .where(inArray(idpOrg.orgId, orgIds))
+        .innerJoin(orgs, eq(orgs.orgId, idpOrg.orgId))
+        .innerJoin(idp, eq(idp.idpId, idpOrg.idpId))
+        .innerJoin(idpOidcConfig, eq(idpOidcConfig.idpId, idpOrg.idpId))
+        .orderBy(sql`idp.name DESC`)
+        .limit(limit)
+        .offset(offset);
+}
+
+async function countIdpsForOrgs(orgIds: string[]) {
+    const [{ count }] = await db
+        .select({ count: sql<number>`count(*)` })
+        .from(idpOrg)
+        .innerJoin(idp, eq(idp.idpId, idpOrg.idpId))
+        .innerJoin(idpOidcConfig, eq(idpOidcConfig.idpId, idpOrg.idpId))
+        .where(inArray(idpOrg.orgId, orgIds));
+    return count;
+}
+
+export async function listUserAdminOrgIdps(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { userId } = parsedParams.data;
+
+        const parsedQuery = querySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+        const { limit, offset } = parsedQuery.data;
+
+        const adminOrgIds = await getOrgIdsWhereUserIsAdmin(userId);
+
+        if (adminOrgIds.length === 0) {
+            return response<ListUserAdminOrgIdpsResponse>(res, {
+                data: {
+                    idps: [],
+                    pagination: {
+                        total: 0,
+                        limit,
+                        offset
+                    }
+                },
+                success: true,
+                error: false,
+                message: "Org Idps retrieved successfully",
+                status: HttpCode.OK
+            });
+        }
+
+        const list = await queryIdpsForOrgs(adminOrgIds, limit, offset);
+        const total = await countIdpsForOrgs(adminOrgIds);
+
+        return response<ListUserAdminOrgIdpsResponse>(res, {
+            data: {
+                idps: list,
+                pagination: {
+                    total,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "Org Idps retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/orgIdp/requireOrgIdentityProviderMode.ts

@@ -0,0 +1,34 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import privateConfig from "#private/lib/config";
+import HttpCode from "@server/types/HttpCode";
+
+export function requireOrgIdentityProviderMode(
+    _req: Request,
+    _res: Response,
+    next: NextFunction
+): void {
+    if (privateConfig.getRawPrivateConfig().app.identity_provider_mode !== "org") {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                "Organization-specific IdP creation is not allowed in the current identity provider mode. Set app.identity_provider_mode to 'org' in the private configuration to enable this feature."
+            )
+        );
+    }
+
+    return next();
+}

server/private/routers/orgIdp/unassociateOrgIdp.ts

@@ -0,0 +1,96 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, idpOrg } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { and, eq, sql } from "drizzle-orm";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z
+    .object({
+        orgId: z.string().nonempty(),
+        idpId: z.coerce.number<number>().int().positive()
+    })
+    .strict();
+
+export async function unassociateOrgIdp(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, idpId } = parsedParams.data;
+
+        const [association] = await db
+            .select()
+            .from(idpOrg)
+            .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId)))
+            .limit(1);
+
+        if (!association) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `IdP with ID ${idpId} is not associated with organization ${orgId}`
+                )
+            );
+        }
+
+        const [{ count }] = await db
+            .select({ count: sql<number>`count(*)` })
+            .from(idpOrg)
+            .where(eq(idpOrg.idpId, idpId));
+
+        if (count <= 1) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "This is the last organization associated with this identity provider. Delete it instead."
+                )
+            );
+        }
+
+        await db
+            .delete(idpOrg)
+            .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId)));
+
+        return response<null>(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Org IdP unassociated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/orgIdp/updateOrgOidcIdp.ts

@@ -26,7 +26,6 @@ import { encrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
 import { isSubscribed } from "#private/lib/isSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import privateConfig from "#private/lib/config";
 import { build } from "@server/build";
 
 const paramsSchema = z
@@ -48,6 +47,7 @@ const bodySchema = z.strictObject({
     scopes: z.string().optional(),
     autoProvision: z.boolean().optional(),
     roleMapping: z.string().optional(),
+    orgMapping: z.string().nullish(),
     tags: z.string().optional()
 });
 
@@ -99,18 +99,6 @@ export async function updateOrgOidcIdp(
             );
         }
 
-        if (
-            privateConfig.getRawPrivateConfig().app.identity_provider_mode !==
-            "org"
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Organization-specific IdP creation is not allowed in the current identity provider mode. Set app.identity_provider_mode to 'org' in the private configuration to enable this feature."
-                )
-            );
-        }
-
         const { idpId, orgId } = parsedParams.data;
         const {
             clientId,
@@ -123,6 +111,7 @@ export async function updateOrgOidcIdp(
             namePath,
             name,
             roleMapping,
+            orgMapping,
             tags
         } = parsedBody.data;
 
@@ -218,13 +207,20 @@ export async function updateOrgOidcIdp(
                     .where(eq(idpOidcConfig.idpId, idpId));
             }
 
+            const idpOrgPolicyPatch: {
+                roleMapping?: string;
+                orgMapping?: string | null;
+            } = {};
             if (roleMapping !== undefined) {
-                // Update IdP-org policy
+                idpOrgPolicyPatch.roleMapping = roleMapping;
+            }
+            if (orgMapping !== undefined) {
+                idpOrgPolicyPatch.orgMapping = orgMapping;
+            }
+            if (Object.keys(idpOrgPolicyPatch).length > 0) {
                 await trx
                     .update(idpOrg)
-                    .set({
-                        roleMapping
-                    })
+                    .set(idpOrgPolicyPatch)
                     .where(
                         and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId))
                     );

server/routers/orgIdp/types.ts

@@ -25,3 +25,22 @@ export type ListOrgIdpsResponse = {
         offset: number;
     };
 };
+
+export type ListUserAdminOrgIdpsEntry = {
+    idpId: number;
+    orgId: string;
+    orgName: string;
+    name: string;
+    type: string;
+    variant: string;
+    tags: string | null;
+};
+
+export type ListUserAdminOrgIdpsResponse = {
+    idps: ListUserAdminOrgIdpsEntry[];
+    pagination: {
+        total: number;
+        limit: number;
+        offset: number;
+    };
+};

src/app/[orgId]/settings/(private)/idp/[idpId]/general/page.tsx

@@ -97,7 +97,8 @@ export default function GeneralPage() {
         emailPath: z.string().nullable().optional(),
         namePath: z.string().nullable().optional(),
         scopes: z.string().min(1, { message: t("idpScopeRequired") }),
-        autoProvision: z.boolean().default(false)
+        autoProvision: z.boolean().default(false),
+        orgMapping: z.string().optional()
     });
 
     // Google form schema (simplified)
@@ -109,7 +110,8 @@ export default function GeneralPage() {
             .min(1, { message: t("idpClientSecretRequired") }),
         roleMapping: z.string().nullable().optional(),
         roleId: z.number().nullable().optional(),
-        autoProvision: z.boolean().default(false)
+        autoProvision: z.boolean().default(false),
+        orgMapping: z.string().optional()
     });
 
     // Azure form schema (simplified with tenant ID)
@@ -122,7 +124,8 @@ export default function GeneralPage() {
         tenantId: z.string().min(1, { message: t("idpTenantIdRequired") }),
         roleMapping: z.string().nullable().optional(),
         roleId: z.number().nullable().optional(),
-        autoProvision: z.boolean().default(false)
+        autoProvision: z.boolean().default(false),
+        orgMapping: z.string().optional()
     });
 
     type OidcFormValues = z.infer<typeof OidcFormSchema>;
@@ -160,7 +163,8 @@ export default function GeneralPage() {
             autoProvision: true,
             roleMapping: null,
             roleId: null,
-            tenantId: ""
+            tenantId: "",
+            orgMapping: ""
         }
     });
 
@@ -227,7 +231,8 @@ export default function GeneralPage() {
                         clientSecret: data.idpOidcConfig.clientSecret,
                         autoProvision: data.idp.autoProvision,
                         roleMapping: roleMapping || null,
-                        roleId: null
+                        roleId: null,
+                        orgMapping: data.idpOrg?.orgMapping ?? ""
                     };
 
                     // Add variant-specific fields
@@ -344,12 +349,14 @@ export default function GeneralPage() {
             }
 
             // Build payload based on variant
+            const orgMappingTrimmed = data.orgMapping?.trim() ?? "";
             let payload: any = {
                 name: data.name,
                 clientId: data.clientId,
                 clientSecret: data.clientSecret,
                 autoProvision: data.autoProvision,
-                roleMapping: roleMappingExpression
+                roleMapping: roleMappingExpression,
+                orgMapping: orgMappingTrimmed === "" ? null : orgMappingTrimmed
             };
 
             // Add variant-specific fields
@@ -532,6 +539,10 @@ export default function GeneralPage() {
                                     }
                                     rawExpression={rawRoleExpression}
                                     onRawExpressionChange={setRawRoleExpression}
+                                    orgMappingField={{
+                                        control: form.control,
+                                        name: "orgMapping"
+                                    }}
                                 />
                             </form>
                         </Form>

src/app/[orgId]/settings/(private)/idp/create/page.tsx

@@ -91,7 +91,8 @@ export default function Page() {
         tenantId: z.string().optional(),
         autoProvision: z.boolean().default(false),
         roleMapping: z.string().nullable().optional(),
-        roleId: z.number().nullable().optional()
+        roleId: z.number().nullable().optional(),
+        orgMapping: z.string().optional()
     });
 
     type CreateIdpFormValues = z.infer<typeof createIdpFormSchema>;
@@ -112,7 +113,8 @@ export default function Page() {
             tenantId: "",
             autoProvision: false,
             roleMapping: null,
-            roleId: null
+            roleId: null,
+            orgMapping: ""
         }
     });
 
@@ -177,7 +179,7 @@ export default function Page() {
                 return;
             }
 
-            const payload = {
+            const payload: Record<string, unknown> = {
                 name: data.name,
                 clientId: data.clientId,
                 clientSecret: data.clientSecret,
@@ -191,6 +193,10 @@ export default function Page() {
                 scopes: data.scopes,
                 variant: data.type
             };
+            const trimmedOrgMapping = data.orgMapping?.trim();
+            if (trimmedOrgMapping) {
+                payload.orgMapping = trimmedOrgMapping;
+            }
 
             // Use the appropriate endpoint based on provider type
             const endpoint = "oidc";
@@ -336,6 +342,10 @@ export default function Page() {
                                     }
                                     rawExpression={rawRoleExpression}
                                     onRawExpressionChange={setRawRoleExpression}
+                                    orgMappingField={{
+                                        control: form.control,
+                                        name: "orgMapping"
+                                    }}
                                 />
                             </form>
                         </Form>

src/app/[orgId]/settings/access/users/create/page.tsx

@@ -46,7 +46,7 @@ import { Checkbox } from "@app/components/ui/checkbox";
 import { ListIdpsResponse } from "@server/routers/idp";
 import { useTranslations } from "next-intl";
 import { build } from "@server/build";
-import Image from "next/image";
+import IdpTypeIcon from "@app/components/IdpTypeIcon";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import OrgRolesTagField from "@app/components/OrgRolesTagField";
@@ -152,31 +152,8 @@ export default function Page() {
 
     const getIdpIcon = (variant: string | null) => {
         if (!variant) return null;
-
-        switch (variant.toLowerCase()) {
-            case "google":
-                return (
-                    <Image
-                        src="/idp/google.png"
-                        alt={t("idpGoogleAlt")}
-                        width={24}
-                        height={24}
-                        className="rounded"
-                    />
-                );
-            case "azure":
-                return (
-                    <Image
-                        src="/idp/azure.png"
-                        alt={t("idpAzureAlt")}
-                        width={24}
-                        height={24}
-                        className="rounded"
-                    />
-                );
-            default:
-                return null;
-        }
+        const type = variant.toLowerCase();
+        return <IdpTypeIcon type={type} size={24} />;
     };
 
     const validFor = [
@@ -340,15 +317,16 @@ export default function Page() {
 
         const roleIds = values.roles.map((r) => parseInt(r.id, 10));
 
-        const res = await api.post<AxiosResponse<InviteUserResponse>>(
-            `/org/${orgId}/create-invite`,
-            {
-                email: values.email,
-                roleIds,
-                validHours: parseInt(values.validForHours),
-                sendEmail
-            }
-        )
+        const res = await api
+            .post<AxiosResponse<InviteUserResponse>>(
+                `/org/${orgId}/create-invite`,
+                {
+                    email: values.email,
+                    roleIds,
+                    validHours: parseInt(values.validForHours),
+                    sendEmail
+                }
+            )
             .catch((e) => {
                 if (e.response?.status === 409) {
                     toast({

src/app/[orgId]/settings/sites/create/page.tsx

@@ -161,16 +161,13 @@ export default function Page() {
             description: t("siteNewtTunnelDescription"),
             disabled: true
         },
-        ...(env.flags.disableBasicWireguardSites
+        ...(env.flags.disableBasicWireguardSites || build == "saas"
             ? []
             : [
                   {
                       id: "wireguard" as SiteType,
                       title: t("siteWg"),
-                      description:
-                          build == "saas"
-                              ? t("siteWgDescriptionSaas")
-                              : t("siteWgDescription"),
+                      description: t("siteWgDescription"),
                       disabled: true
                   }
               ]),
@@ -426,9 +423,22 @@ export default function Page() {
                                 }));
 
                         setRemoteExitNodeOptions(exitNodeOptions);
+
+                        if (exitNodeOptions.length === 0) {
+                            // No remote exit nodes available — remove local option and default to newt
+                            setTunnelTypes((prev: any) =>
+                                prev.filter((item: any) => item.id !== "local")
+                            );
+                            form.setValue("method", "newt");
+                        }
                     }
                 } catch (error) {
                     console.error("Failed to fetch remote exit nodes:", error);
+                    // If fetch fails, no remote exit nodes available — remove local option and default to newt
+                    setTunnelTypes((prev: any) =>
+                        prev.filter((item: any) => item.id !== "local")
+                    );
+                    form.setValue("method", "newt");
                 }
             }
 

src/app/admin/idp/[idpId]/policies/page.tsx

@@ -20,7 +20,6 @@ import {
 import {
     Form,
     FormControl,
-    FormDescription,
     FormField,
     FormItem,
     FormLabel,
@@ -63,7 +62,7 @@ import {
     SettingsSectionForm
 } from "@app/components/Settings";
 import { useTranslations } from "next-intl";
-import RoleMappingConfigFields from "@app/components/RoleMappingConfigFields";
+import AutoProvisionConfigWidget from "@app/components/AutoProvisionConfigWidget";
 import {
     compileRoleMappingExpression,
     createMappingBuilderRule,
@@ -499,9 +498,17 @@ export default function PoliciesPage() {
                                 id="policy-default-mappings-form"
                                 className="space-y-6"
                             >
-                                <RoleMappingConfigFields
-                                    fieldIdPrefix="admin-idp-default-role"
-                                    showFreeformRoleNamesHint={true}
+                                <AutoProvisionConfigWidget
+                                    showAutoProvisionSwitch={false}
+                                    autoProvision={true}
+                                    onAutoProvisionChange={() => {}}
+                                    orgMappingField={{
+                                        control: defaultMappingsForm.control,
+                                        name: "defaultOrgMapping",
+                                        labelKey: "defaultMappingsOrg"
+                                    }}
+                                    roleMappingFieldIdPrefix="admin-idp-default-role"
+                                    showFreeformRoleNamesHint
                                     roleMappingMode={defaultRoleMappingMode}
                                     onRoleMappingModeChange={
                                         setDefaultRoleMappingMode
@@ -528,27 +535,6 @@ export default function PoliciesPage() {
                                         setDefaultRawRoleExpression
                                     }
                                 />
-
-                                <FormField
-                                    control={defaultMappingsForm.control}
-                                    name="defaultOrgMapping"
-                                    render={({ field }) => (
-                                        <FormItem>
-                                            <FormLabel>
-                                                {t("defaultMappingsOrg")}
-                                            </FormLabel>
-                                            <FormControl>
-                                                <Input {...field} />
-                                            </FormControl>
-                                            <FormDescription>
-                                                {t(
-                                                    "defaultMappingsOrgDescription"
-                                                )}
-                                            </FormDescription>
-                                            <FormMessage />
-                                        </FormItem>
-                                    )}
-                                />
                             </form>
                         </Form>
                         <SettingsSectionFooter>
@@ -687,9 +673,15 @@ export default function PoliciesPage() {
                                     )}
                                 />
 
-                                <RoleMappingConfigFields
-                                    fieldIdPrefix="admin-idp-policy-role"
-                                    showFreeformRoleNamesHint={false}
+                                <AutoProvisionConfigWidget
+                                    showAutoProvisionSwitch={false}
+                                    autoProvision={true}
+                                    onAutoProvisionChange={() => {}}
+                                    orgMappingField={{
+                                        control: form.control,
+                                        name: "orgMapping"
+                                    }}
+                                    roleMappingFieldIdPrefix="admin-idp-policy-role"
                                     roleMappingMode={policyRoleMappingMode}
                                     onRoleMappingModeChange={
                                         setPolicyRoleMappingMode
@@ -716,27 +708,6 @@ export default function PoliciesPage() {
                                         setPolicyRawRoleExpression
                                     }
                                 />
-
-                                <FormField
-                                    control={form.control}
-                                    name="orgMapping"
-                                    render={({ field }) => (
-                                        <FormItem>
-                                            <FormLabel>
-                                                {t("orgMappingPathOptional")}
-                                            </FormLabel>
-                                            <FormControl>
-                                                <Input {...field} />
-                                            </FormControl>
-                                            <FormDescription>
-                                                {t(
-                                                    "defaultMappingsOrgDescription"
-                                                )}
-                                            </FormDescription>
-                                            <FormMessage />
-                                        </FormItem>
-                                    )}
-                                />
                             </form>
                         </Form>
                     </CredenzaBody>

src/app/admin/idp/create/page.tsx

@@ -24,7 +24,6 @@ import {
 import HeaderTitle from "@app/components/SettingsSectionTitle";
 import IdpAutoProvisionUsersDescription from "@app/components/IdpAutoProvisionUsersDescription";
 import { SwitchInput } from "@app/components/SwitchInput";
-import { Alert, AlertDescription, AlertTitle } from "@app/components/ui/alert";
 import { Button } from "@app/components/ui/button";
 import { Input } from "@app/components/ui/input";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
@@ -34,7 +33,6 @@ import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { applyOidcIdpProviderType } from "@app/lib/idp/oidcIdpProviderDefaults";
 import { zodResolver } from "@hookform/resolvers/zod";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import { InfoIcon } from "lucide-react";
 import { useTranslations } from "next-intl";
 import { useRouter } from "next/navigation";
 import { useState } from "react";
@@ -220,23 +218,6 @@ export default function Page() {
                                             )}
                                         />
 
-                                        <div className="flex items-start mb-0">
-                                            <SwitchInput
-                                                id="auto-provision-toggle"
-                                                label={t(
-                                                    "idpAutoProvisionUsers"
-                                                )}
-                                                defaultChecked={form.getValues(
-                                                    "autoProvision"
-                                                )}
-                                                onCheckedChange={(checked) => {
-                                                    form.setValue(
-                                                        "autoProvision",
-                                                        checked
-                                                    );
-                                                }}
-                                            />
-                                        </div>
                                     </form>
                                 </Form>
                             </SettingsSectionForm>
@@ -244,6 +225,32 @@ export default function Page() {
                     </SettingsSectionBody>
                 </SettingsSection>
 
+                <SettingsSection>
+                    <SettingsSectionHeader>
+                        <SettingsSectionTitle>
+                            {t("idpAutoProvisionUsers")}
+                        </SettingsSectionTitle>
+                        <SettingsSectionDescription>
+                            <IdpAutoProvisionUsersDescription />
+                        </SettingsSectionDescription>
+                    </SettingsSectionHeader>
+                    <SettingsSectionBody>
+                        <div className="space-y-2">
+                            <SwitchInput
+                                id="auto-provision-toggle"
+                                label={t("idpAutoProvisionUsers")}
+                                defaultChecked={form.getValues("autoProvision")}
+                                onCheckedChange={(checked) => {
+                                    form.setValue("autoProvision", checked);
+                                }}
+                            />
+                            <p className="text-sm text-muted-foreground">
+                                {t("idpAutoProvisionConfigureAfterCreate")}
+                            </p>
+                        </div>
+                    </SettingsSectionBody>
+                </SettingsSection>
+
                 <fieldset
                     disabled={templatesLocked}
                     className="min-w-0 border-0 p-0 m-0 disabled:pointer-events-none disabled:opacity-60"

src/components/AutoProvisionConfigWidget.tsx

@@ -1,19 +1,33 @@
 "use client";
 
-import IdpAutoProvisionUsersDescription from "@app/components/IdpAutoProvisionUsersDescription";
-import { FormDescription } from "@app/components/ui/form";
+import { HorizontalTabs } from "@app/components/HorizontalTabs";
+import RoleMappingConfigFields from "@app/components/RoleMappingConfigFields";
 import { SwitchInput } from "@app/components/SwitchInput";
-import { useTranslations } from "next-intl";
+import {
+    FormControl,
+    FormField,
+    FormItem,
+    FormLabel,
+    FormMessage
+} from "@app/components/ui/form";
+import { Input } from "@app/components/ui/input";
+import { MappingBuilderRule, RoleMappingMode } from "@app/lib/idpRoleMapping";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import { MappingBuilderRule, RoleMappingMode } from "@app/lib/idpRoleMapping";
-import RoleMappingConfigFields from "@app/components/RoleMappingConfigFields";
+import { useTranslations } from "next-intl";
+import type { Control } from "react-hook-form";
 
 type Role = {
     roleId: number;
     name: string;
 };
 
+export type IdpOrgMappingFieldBinding = {
+    control: unknown;
+    name: string;
+    labelKey?: string;
+};
+
 type AutoProvisionConfigWidgetProps = {
     autoProvision: boolean;
     onAutoProvisionChange: (checked: boolean) => void;
@@ -28,6 +42,11 @@ type AutoProvisionConfigWidgetProps = {
     onMappingBuilderRulesChange: (rules: MappingBuilderRule[]) => void;
     rawExpression: string;
     onRawExpressionChange: (expression: string) => void;
+    orgMappingField: IdpOrgMappingFieldBinding;
+    showAutoProvisionSwitch?: boolean;
+    roleMappingFieldIdPrefix?: string;
+    showFreeformRoleNamesHint?: boolean;
+    autoProvisionSwitchId?: string;
 };
 
 export default function AutoProvisionConfigWidget({
@@ -43,41 +62,95 @@ export default function AutoProvisionConfigWidget({
     mappingBuilderRules,
     onMappingBuilderRulesChange,
     rawExpression,
-    onRawExpressionChange
+    onRawExpressionChange,
+    orgMappingField,
+    showAutoProvisionSwitch = true,
+    roleMappingFieldIdPrefix = "org-idp-auto-provision",
+    showFreeformRoleNamesHint = false,
+    autoProvisionSwitchId = "auto-provision-toggle"
 }: AutoProvisionConfigWidgetProps) {
     const t = useTranslations();
     const { isPaidUser } = usePaidStatus();
 
+    const showMappingTabs = showAutoProvisionSwitch === false || autoProvision;
+
+    const orgMappingLabelKey =
+        orgMappingField.labelKey ?? "orgMappingPathOptional";
+
     return (
         <div className="space-y-4">
-            <div className="mb-4">
-                <SwitchInput
-                    id="auto-provision-toggle"
-                    label={t("idpAutoProvisionUsers")}
-                    defaultChecked={autoProvision}
-                    onCheckedChange={onAutoProvisionChange}
-                    disabled={!isPaidUser(tierMatrix.autoProvisioning)}
-                />
-            </div>
+            {showAutoProvisionSwitch && (
+                <div className="mb-4">
+                    <SwitchInput
+                        id={autoProvisionSwitchId}
+                        label={t("idpAutoProvisionUsers")}
+                        defaultChecked={autoProvision}
+                        onCheckedChange={onAutoProvisionChange}
+                        disabled={!isPaidUser(tierMatrix.autoProvisioning)}
+                    />
+                </div>
+            )}
 
-            {autoProvision && (
-                <RoleMappingConfigFields
-                    fieldIdPrefix="org-idp-auto-provision"
-                    showFreeformRoleNamesHint={false}
-                    roleMappingMode={roleMappingMode}
-                    onRoleMappingModeChange={onRoleMappingModeChange}
-                    roles={roles}
-                    fixedRoleNames={fixedRoleNames}
-                    onFixedRoleNamesChange={onFixedRoleNamesChange}
-                    mappingBuilderClaimPath={mappingBuilderClaimPath}
-                    onMappingBuilderClaimPathChange={
-                        onMappingBuilderClaimPathChange
-                    }
-                    mappingBuilderRules={mappingBuilderRules}
-                    onMappingBuilderRulesChange={onMappingBuilderRulesChange}
-                    rawExpression={rawExpression}
-                    onRawExpressionChange={onRawExpressionChange}
-                />
+            {showMappingTabs && (
+                <HorizontalTabs
+                    clientSide
+                    defaultTab={0}
+                    items={[
+                        { title: t("roleMapping"), href: "#" },
+                        { title: t("orgMapping"), href: "#" }
+                    ]}
+                >
+                    <div className="space-y-4 mt-4 p-1">
+                        <RoleMappingConfigFields
+                            fieldIdPrefix={roleMappingFieldIdPrefix}
+                            showFreeformRoleNamesHint={
+                                showFreeformRoleNamesHint
+                            }
+                            roleMappingMode={roleMappingMode}
+                            onRoleMappingModeChange={onRoleMappingModeChange}
+                            roles={roles}
+                            fixedRoleNames={fixedRoleNames}
+                            onFixedRoleNamesChange={onFixedRoleNamesChange}
+                            mappingBuilderClaimPath={mappingBuilderClaimPath}
+                            onMappingBuilderClaimPathChange={
+                                onMappingBuilderClaimPathChange
+                            }
+                            mappingBuilderRules={mappingBuilderRules}
+                            onMappingBuilderRulesChange={
+                                onMappingBuilderRulesChange
+                            }
+                            rawExpression={rawExpression}
+                            onRawExpressionChange={onRawExpressionChange}
+                        />
+                    </div>
+                    <div className="space-y-4 mt-4 p-1">
+                        <div className="space-y-4">
+                            <p className="text-sm text-muted-foreground">
+                                {t("defaultMappingsOrgDescription")}
+                            </p>
+                            <FormField
+                                control={
+                                    orgMappingField.control as Control<any>
+                                }
+                                name={orgMappingField.name}
+                                render={({ field }) => (
+                                    <FormItem>
+                                        <FormLabel>
+                                            {t(orgMappingLabelKey)}
+                                        </FormLabel>
+                                        <FormControl>
+                                            <Input
+                                                {...field}
+                                                placeholder="e.g., ends_with(email, '@organization.com')"
+                                            />
+                                        </FormControl>
+                                        <FormMessage />
+                                    </FormItem>
+                                )}
+                            />
+                        </div>
+                    </div>
+                </HorizontalTabs>
             )}
         </div>
     );

src/components/IdpLoginButtons.tsx

@@ -4,7 +4,7 @@ import { useEffect, useState } from "react";
 import { Button } from "@app/components/ui/button";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import Image from "next/image";
+import IdpTypeIcon from "@app/components/IdpTypeIcon";
 import {
     generateOidcUrlProxy,
     type GenerateOidcUrlResponse
@@ -135,24 +135,7 @@ export default function IdpLoginButtons({
                                     disabled={loading}
                                     loading={loading}
                                 >
-                                    {effectiveType === "google" && (
-                                        <Image
-                                            src="/idp/google.png"
-                                            alt="Google"
-                                            width={16}
-                                            height={16}
-                                            className="rounded"
-                                        />
-                                    )}
-                                    {effectiveType === "azure" && (
-                                        <Image
-                                            src="/idp/azure.png"
-                                            alt="Azure"
-                                            width={16}
-                                            height={16}
-                                            className="rounded"
-                                        />
-                                    )}
+                                    <IdpTypeIcon type={effectiveType} size={16} />
                                     <span>{idp.name}</span>
                                 </Button>
                             );

src/components/IdpTypeBadge.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { Badge } from "@app/components/ui/badge";
-import Image from "next/image";
+import IdpTypeIcon from "@app/components/IdpTypeIcon";
 
 type IdpTypeBadgeProps = {
     type: string;
@@ -29,34 +29,8 @@ export default function IdpTypeBadge({
             variant="secondary"
             className="inline-flex items-center space-x-1 w-fit"
         >
-            {effectiveType === "google" && (
-                <>
-                    <Image
-                        src="/idp/google.png"
-                        alt="Google"
-                        width={16}
-                        height={16}
-                        className="rounded"
-                    />
-                    <span>{effectiveName}</span>
-                </>
-            )}
-            {effectiveType === "azure" && (
-                <>
-                    <Image
-                        src="/idp/azure.png"
-                        alt="Azure"
-                        width={16}
-                        height={16}
-                        className="rounded"
-                    />
-                    <span>{effectiveName}</span>
-                </>
-            )}
-            {effectiveType === "oidc" && <span>{effectiveName}</span>}
-            {!["google", "azure", "oidc"].includes(effectiveType) && (
-                <span>{effectiveName}</span>
-            )}
+            <IdpTypeIcon type={effectiveType} size={16} />
+            <span>{effectiveName}</span>
         </Badge>
     );
 }

src/components/IdpTypeIcon.tsx

@@ -0,0 +1,53 @@
+"use client";
+
+import { cn } from "@app/lib/cn";
+import Image from "next/image";
+import { ReactNode } from "react";
+
+type Props = {
+    type?: string | null;
+    variant?: string | null;
+    size?: number;
+    className?: string;
+    alt?: string;
+    fallback?: ReactNode;
+};
+
+export default function IdpTypeIcon({
+    type,
+    variant,
+    size = 16,
+    className,
+    alt,
+    fallback = null
+}: Props) {
+    const effectiveType = (variant || type || "").toLowerCase();
+
+    let src: string | null = null;
+    let defaultAlt = "";
+
+    if (effectiveType === "google") {
+        src = "/idp/google.png";
+        defaultAlt = "Google";
+    } else if (effectiveType === "azure") {
+        src = "/idp/azure.png";
+        defaultAlt = "Azure";
+    } else if (effectiveType === "oidc") {
+        src = "/idp/openid.png";
+        defaultAlt = "OAuth2/OIDC";
+    }
+
+    if (!src) {
+        return <>{fallback}</>;
+    }
+
+    return (
+        <Image
+            src={src}
+            alt={alt ?? defaultAlt}
+            width={size}
+            height={size}
+            className={cn("shrink-0 rounded", className)}
+        />
+    );
+}

src/components/LayoutSidebar.tsx

@@ -24,10 +24,8 @@ import dynamic from "next/dynamic";
 import Link from "next/link";
 import { usePathname } from "next/navigation";
 import { useEffect, useState } from "react";
-import { FaGithub } from "react-icons/fa";
 import SidebarLicenseButton from "./SidebarLicenseButton";
 import { SidebarSupportButton } from "./SidebarSupportButton";
-import { is } from "drizzle-orm";
 
 const ProductUpdates = dynamic(() => import("./ProductUpdates"), {
     ssr: false
@@ -291,7 +289,6 @@ export function LayoutSidebar({
                                             : build === "enterprise"
                                               ? t("enterpriseEdition")
                                               : "Pangolin Cloud"}
-                                        <FaGithub size={12} />
                                     </Link>
                                 </div>
                                 {build === "enterprise" &&

src/components/LoginForm.tsx

@@ -27,7 +27,6 @@ import { LockIcon } from "lucide-react";
 import SecurityKeyAuthButton from "@app/components/SecurityKeyAuthButton";
 import { createApiClient } from "@app/lib/api";
 import Link from "next/link";
-import Image from "next/image";
 import { GenerateOidcUrlResponse } from "@server/routers/idp";
 import { Separator } from "./ui/separator";
 import { useTranslations } from "next-intl";
@@ -37,6 +36,7 @@ import {
 } from "@app/actions/server";
 import { redirect as redirectTo } from "next/navigation";
 import { useEnvContext } from "@app/hooks/useEnvContext";
+import IdpTypeIcon from "@app/components/IdpTypeIcon";
 // @ts-ignore
 import { loadReoScript } from "reodotdev";
 import { build } from "@server/build";
@@ -393,24 +393,7 @@ export default function LoginForm({
                                                 loginWithIdp(idp.idpId);
                                             }}
                                         >
-                                            {effectiveType === "google" && (
-                                                <Image
-                                                    src="/idp/google.png"
-                                                    alt="Google"
-                                                    width={16}
-                                                    height={16}
-                                                    className="rounded"
-                                                />
-                                            )}
-                                            {effectiveType === "azure" && (
-                                                <Image
-                                                    src="/idp/azure.png"
-                                                    alt="Azure"
-                                                    width={16}
-                                                    height={16}
-                                                    className="rounded"
-                                                />
-                                            )}
+                                            <IdpTypeIcon type={effectiveType} size={16} />
                                             <span>{idp.name}</span>
                                         </Button>
                                     );

src/components/OrgIdpDataTable.tsx

@@ -1,19 +1,24 @@
 "use client";
 
 import { ColumnDef } from "@tanstack/react-table";
-import { DataTable } from "@app/components/ui/data-table";
+import {
+    DataTable,
+    type DataTableAddAction
+} from "@app/components/ui/data-table";
 import { useTranslations } from "next-intl";
 
 interface DataTableProps<TData, TValue> {
     columns: ColumnDef<TData, TValue>[];
     data: TData[];
     onAdd?: () => void;
+    addActions?: DataTableAddAction[];
 }
 
 export function IdpDataTable<TData, TValue>({
     columns,
     data,
-    onAdd
+    onAdd,
+    addActions
 }: DataTableProps<TData, TValue>) {
     const t = useTranslations();
 
@@ -27,6 +32,7 @@ export function IdpDataTable<TData, TValue>({
             searchColumn="name"
             addButtonText={t("idpAdd")}
             onAdd={onAdd}
+            addActions={addActions}
             enableColumnVisibility={true}
             stickyRightColumn="actions"
         />

src/components/OrgIdpTable.tsx

@@ -4,13 +4,37 @@ import { ColumnDef } from "@tanstack/react-table";
 import { ExtendedColumnDef } from "@app/components/ui/data-table";
 import { IdpDataTable } from "@app/components/OrgIdpDataTable";
 import { Button } from "@app/components/ui/button";
-import { ArrowRight, ArrowUpDown, MoreHorizontal } from "lucide-react";
-import { useState } from "react";
+import {
+    Command,
+    CommandEmpty,
+    CommandGroup,
+    CommandInput,
+    CommandItem,
+    CommandList
+} from "@app/components/ui/command";
+import {
+    Credenza,
+    CredenzaBody,
+    CredenzaClose,
+    CredenzaContent,
+    CredenzaDescription,
+    CredenzaFooter,
+    CredenzaHeader,
+    CredenzaTitle
+} from "@app/components/Credenza";
+import {
+    ArrowRight,
+    ArrowUpDown,
+    KeyRound,
+    MoreHorizontal
+} from "lucide-react";
+import { useMemo, useState } from "react";
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import { toast } from "@app/hooks/useToast";
 import { formatAxiosError } from "@app/lib/api";
 import { createApiClient } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useUserContext } from "@app/hooks/useUserContext";
 import { useRouter } from "next/navigation";
 import {
     DropdownMenu,
@@ -21,6 +45,13 @@ import {
 import Link from "next/link";
 import { useTranslations } from "next-intl";
 import IdpTypeBadge from "@app/components/IdpTypeBadge";
+import IdpTypeIcon from "@app/components/IdpTypeIcon";
+import { useQuery } from "@tanstack/react-query";
+import { useDebounce } from "use-debounce";
+import type { ListUserAdminOrgIdpsResponse } from "@server/routers/orgIdp/types";
+import { cn } from "@app/lib/cn";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
+import { tierMatrix } from "@server/lib/billing/tierMatrix";
 
 export type IdpRow = {
     idpId: number;
@@ -29,6 +60,15 @@ export type IdpRow = {
     variant?: string;
 };
 
+type AdminIdpRow = ListUserAdminOrgIdpsResponse["idps"][number];
+
+function IdpImportRowIcon({
+    type,
+    variant
+}: Pick<AdminIdpRow, "type" | "variant">) {
+    return <IdpTypeIcon type={type} variant={variant} size={20} />;
+}
+
 type Props = {
     idps: IdpRow[];
     orgId: string;
@@ -37,10 +77,51 @@ type Props = {
 export default function IdpTable({ idps, orgId }: Props) {
     const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
     const [selectedIdp, setSelectedIdp] = useState<IdpRow | null>(null);
+    const [isUnassociateModalOpen, setIsUnassociateModalOpen] = useState(false);
+    const [selectedUnassociateIdp, setSelectedUnassociateIdp] =
+        useState<IdpRow | null>(null);
+    const [importDialogOpen, setImportDialogOpen] = useState(false);
+    const [importSearchQuery, setImportSearchQuery] = useState("");
+    const [importSubmitting, setImportSubmitting] = useState(false);
+    const [debouncedImportSearch] = useDebounce(importSearchQuery, 150);
+
     const api = createApiClient(useEnvContext());
+    const { user } = useUserContext();
+    const { isPaidUser } = usePaidStatus();
     const router = useRouter();
     const t = useTranslations();
 
+    const canImportOrgOidcIdp = isPaidUser(tierMatrix.orgOidc);
+
+    const { data: adminIdpsRaw = [] } = useQuery({
+        queryKey: ["admin-org-idps", user.userId],
+        queryFn: async () => {
+            const res = await api.get<{
+                data: ListUserAdminOrgIdpsResponse;
+            }>(`/user/${user.userId}/admin-org-idps`);
+            return res.data.data.idps;
+        },
+        enabled: importDialogOpen && !!user?.userId
+    });
+
+    const importableIdps = useMemo(() => {
+        const localIds = new Set(idps.map((i) => i.idpId));
+        return adminIdpsRaw.filter(
+            (row) => row.orgId !== orgId && !localIds.has(row.idpId)
+        );
+    }, [adminIdpsRaw, orgId, idps]);
+
+    const shownImportIdps = useMemo(() => {
+        const q = debouncedImportSearch.trim().toLowerCase();
+        if (!q) {
+            return importableIdps;
+        }
+        return importableIdps.filter((row) => {
+            const hay = `${row.orgName} ${row.name}`.toLowerCase();
+            return hay.includes(q);
+        });
+    }, [importableIdps, debouncedImportSearch]);
+
     const deleteIdp = async (idpId: number) => {
         try {
             await api.delete(`/org/${orgId}/idp/${idpId}`);
@@ -59,6 +140,49 @@ export default function IdpTable({ idps, orgId }: Props) {
         }
     };
 
+    const importIdp = async (row: AdminIdpRow) => {
+        setImportSubmitting(true);
+        try {
+            await api.post(`/org/${orgId}/idp/${row.idpId}/import`, {
+                sourceOrgId: row.orgId
+            });
+            toast({
+                title: t("success"),
+                description: t("idpImportedDescription")
+            });
+            setImportDialogOpen(false);
+            setImportSearchQuery("");
+            router.refresh();
+            router.push(`/${orgId}/settings/idp/${row.idpId}/general`);
+        } catch (e) {
+            toast({
+                title: t("error"),
+                description: formatAxiosError(e),
+                variant: "destructive"
+            });
+        } finally {
+            setImportSubmitting(false);
+        }
+    };
+
+    const unassociateIdp = async (idpId: number) => {
+        try {
+            await api.delete(`/org/${orgId}/idp/${idpId}/association`);
+            toast({
+                title: t("success"),
+                description: t("idpUnassociatedDescription")
+            });
+            setIsUnassociateModalOpen(false);
+            router.refresh();
+        } catch (e) {
+            toast({
+                title: t("error"),
+                description: formatAxiosError(e),
+                variant: "destructive"
+            });
+        }
+    };
+
     const columns: ExtendedColumnDef<IdpRow>[] = [
         {
             accessorKey: "idpId",
@@ -142,6 +266,14 @@ export default function IdpTable({ idps, orgId }: Props) {
                                         {t("viewSettings")}
                                     </DropdownMenuItem>
                                 </Link>
+                                <DropdownMenuItem
+                                    onClick={() => {
+                                        setSelectedUnassociateIdp(siteRow);
+                                        setIsUnassociateModalOpen(true);
+                                    }}
+                                >
+                                    {t("idpUnassociateMenu")}
+                                </DropdownMenuItem>
                                 <DropdownMenuItem
                                     onClick={() => {
                                         setSelectedIdp(siteRow);
@@ -149,7 +281,7 @@ export default function IdpTable({ idps, orgId }: Props) {
                                     }}
                                 >
                                     <span className="text-red-500">
-                                        {t("delete")}
+                                        {t("idpDeleteAllOrgsMenu")}
                                     </span>
                                 </DropdownMenuItem>
                             </DropdownMenuContent>
@@ -179,8 +311,8 @@ export default function IdpTable({ idps, orgId }: Props) {
                     }}
                     dialog={
                         <div className="space-y-2">
-                            <p>{t("idpQuestionRemove")}</p>
-                            <p>{t("idpMessageRemove")}</p>
+                            <p>{t("idpDeleteGlobalQuestion")}</p>
+                            <p>{t("idpDeleteGlobalDescription")}</p>
                         </div>
                     }
                     buttonText={t("idpConfirmDelete")}
@@ -189,11 +321,126 @@ export default function IdpTable({ idps, orgId }: Props) {
                     title={t("idpDelete")}
                 />
             )}
+            {selectedUnassociateIdp && (
+                <ConfirmDeleteDialog
+                    open={isUnassociateModalOpen}
+                    setOpen={(val) => {
+                        setIsUnassociateModalOpen(val);
+                        setSelectedUnassociateIdp(null);
+                    }}
+                    dialog={
+                        <div className="space-y-2">
+                            <p>{t("idpUnassociateQuestion")}</p>
+                            <p>{t("idpUnassociateDescription")}</p>
+                        </div>
+                    }
+                    buttonText={t("idpUnassociateConfirm")}
+                    onConfirm={async () =>
+                        unassociateIdp(selectedUnassociateIdp.idpId)
+                    }
+                    string={selectedUnassociateIdp.name}
+                    title={t("idpUnassociateTitle")}
+                    warningText={t("idpUnassociateWarning")}
+                />
+            )}
+
+            <Credenza
+                open={importDialogOpen}
+                onOpenChange={(open) => {
+                    setImportDialogOpen(open);
+                    if (!open) {
+                        setImportSearchQuery("");
+                    }
+                }}
+            >
+                <CredenzaContent className="sm:max-w-lg">
+                    <CredenzaHeader>
+                        <CredenzaTitle>
+                            {t("idpImportDialogTitle")}
+                        </CredenzaTitle>
+                        <CredenzaDescription>
+                            {t("idpImportDialogDescription")}
+                        </CredenzaDescription>
+                    </CredenzaHeader>
+                    <CredenzaBody
+                        className={cn(
+                            importSubmitting && "pointer-events-none opacity-60"
+                        )}
+                    >
+                        <Command shouldFilter={false}>
+                            <CommandInput
+                                placeholder={t("idpImportSearchPlaceholder")}
+                                value={importSearchQuery}
+                                onValueChange={setImportSearchQuery}
+                            />
+                            <CommandList>
+                                <CommandEmpty>
+                                    {t("idpImportEmpty")}
+                                </CommandEmpty>
+                                <CommandGroup>
+                                    {shownImportIdps.map((row) => (
+                                        <CommandItem
+                                            key={`${row.idpId}:${row.orgId}`}
+                                            className="items-start gap-3 py-2.5"
+                                            value={`${row.idpId}:${row.orgId}:${row.orgName}:${row.name}`}
+                                            disabled={!canImportOrgOidcIdp}
+                                            onSelect={() => {
+                                                if (!canImportOrgOidcIdp) {
+                                                    return;
+                                                }
+                                                void importIdp(row);
+                                            }}
+                                        >
+                                            <div className="mt-0.5 shrink-0">
+                                                <IdpImportRowIcon
+                                                    type={row.type}
+                                                    variant={row.variant}
+                                                />
+                                            </div>
+                                            <div className="min-w-0 flex-1 text-left">
+                                                <div className="truncate font-medium leading-tight">
+                                                    {row.orgName}
+                                                </div>
+                                                <div className="truncate text-sm leading-tight text-muted-foreground">
+                                                    {row.name}
+                                                </div>
+                                            </div>
+                                        </CommandItem>
+                                    ))}
+                                </CommandGroup>
+                            </CommandList>
+                        </Command>
+                    </CredenzaBody>
+                    <CredenzaFooter>
+                        <CredenzaClose asChild>
+                            <Button
+                                variant="outline"
+                                disabled={importSubmitting}
+                            >
+                                {t("cancel")}
+                            </Button>
+                        </CredenzaClose>
+                    </CredenzaFooter>
+                </CredenzaContent>
+            </Credenza>
 
             <IdpDataTable
                 columns={columns}
                 data={idps}
-                onAdd={() => router.push(`/${orgId}/settings/idp/create`)}
+                addActions={[
+                    {
+                        label: t("idpAddActionCreateNew"),
+                        onSelect: () => {
+                            router.push(`/${orgId}/settings/idp/create`);
+                        }
+                    },
+                    {
+                        label: t("idpAddActionImportFromOrg"),
+                        onSelect: () => {
+                            setImportDialogOpen(true);
+                        }
+                    }
+                ]}
             />
         </>
     );

src/components/ProductUpdates.tsx

@@ -103,29 +103,27 @@ export default function ProductUpdates({
             )}
         >
             <div className="flex flex-col gap-1">
-                <small
-                    className={cn(
-                        "text-xs text-muted-foreground flex items-center gap-1 mt-2 empty:mt-0",
-                        showMoreUpdatesText
-                            ? "animate-in fade-in duration-300"
-                            : "opacity-0"
-                    )}
-                >
-                    {filteredUpdates.length > 1 && (
-                        <>
-                            <BellIcon className="flex-none size-3" />
-                            <span>
-                                {showNewVersionPopup
-                                    ? t("productUpdateMoreInfo", {
-                                          noOfUpdates: filteredUpdates.length
-                                      })
-                                    : t("productUpdateInfo", {
-                                          noOfUpdates: filteredUpdates.length
-                                      })}
-                            </span>
-                        </>
-                    )}
-                </small>
+                {filteredUpdates.length > 1 && (
+                    <small
+                        className={cn(
+                            "text-xs text-muted-foreground flex items-center gap-1 mt-2",
+                            showMoreUpdatesText
+                                ? "animate-in fade-in duration-300"
+                                : "opacity-0"
+                        )}
+                    >
+                        <BellIcon className="flex-none size-3" />
+                        <span>
+                            {showNewVersionPopup
+                                ? t("productUpdateMoreInfo", {
+                                      noOfUpdates: filteredUpdates.length
+                                  })
+                                : t("productUpdateInfo", {
+                                      noOfUpdates: filteredUpdates.length
+                                  })}
+                        </span>
+                    </small>
+                )}
                 <ProductUpdatesListPopup
                     updates={filteredUpdates}
                     show={filteredUpdates.length > 0}
@@ -378,7 +376,7 @@ function NewVersionAvailable({
                             <span>
                                 {t("pangolinUpdateAvailableReleaseNotes")}
                             </span>
-                            <ArrowRight className="flex-none size-3 transition-transform duration-300 ease-in-out group-hover:translate-x-1" />
+                            <ArrowRight className="flex-none size-3" />
                         </div>
                     </div>
                 </a>

src/components/RoleMappingConfigFields.tsx

@@ -79,10 +79,7 @@ export default function RoleMappingConfigFields({
     );
 
     useEffect(() => {
-        if (
-            !supportsMultipleRolesPerUser &&
-            mappingBuilderRules.length > 1
-        ) {
+        if (!supportsMultipleRolesPerUser && mappingBuilderRules.length > 1) {
             onMappingBuilderRulesChange([mappingBuilderRules[0]]);
         }
     }, [
@@ -95,11 +92,7 @@ export default function RoleMappingConfigFields({
         if (!supportsMultipleRolesPerUser && fixedRoleNames.length > 1) {
             onFixedRoleNamesChange([fixedRoleNames[0]]);
         }
-    }, [
-        supportsMultipleRolesPerUser,
-        fixedRoleNames,
-        onFixedRoleNamesChange
-    ]);
+    }, [supportsMultipleRolesPerUser, fixedRoleNames, onFixedRoleNamesChange]);
 
     const fixedRadioId = `${fieldIdPrefix}-fixed-roles-mode`;
     const builderRadioId = `${fieldIdPrefix}-mapping-builder-mode`;
@@ -116,7 +109,6 @@ export default function RoleMappingConfigFields({
     return (
         <div className="space-y-4">
             <div>
-                <FormLabel className="mb-2">{t("roleMapping")}</FormLabel>
                 <FormDescription className="mb-4">
                     {t("roleMappingDescription")}
                 </FormDescription>
@@ -272,7 +264,9 @@ export default function RoleMappingConfigFields({
                                 supportsMultipleRolesPerUser={
                                     supportsMultipleRolesPerUser
                                 }
-                                showRemoveButton={mappingBuilderShowsRemoveColumn}
+                                showRemoveButton={
+                                    mappingBuilderShowsRemoveColumn
+                                }
                                 rule={rule}
                                 onChange={(nextRule) => {
                                     const nextRules = mappingBuilderRules.map(
@@ -390,12 +384,10 @@ function BuilderRuleRow({
                             text: name
                         }))}
                         setTags={(nextTags) => {
-                            const prevRoleTags = rule.roleNames.map(
-                                (name) => ({
-                                    id: name,
-                                    text: name
-                                })
-                            );
+                            const prevRoleTags = rule.roleNames.map((name) => ({
+                                id: name,
+                                text: name
+                            }));
                             const next =
                                 typeof nextTags === "function"
                                     ? nextTags(prevRoleTags)

src/components/idp/OidcIdpProviderTypeSelect.tsx

@@ -6,8 +6,8 @@ import {
 } from "@app/components/StrategySelect";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import type { IdpOidcProviderType } from "@app/lib/idp/oidcIdpProviderDefaults";
+import IdpTypeIcon from "@app/components/IdpTypeIcon";
 import { useTranslations } from "next-intl";
-import Image from "next/image";
 import { useEffect, useMemo } from "react";
 
 type Props = {
@@ -32,7 +32,8 @@ export function OidcIdpProviderTypeSelect({ value, onTypeChange }: Props) {
                 {
                     id: "oidc",
                     title: "OAuth2/OIDC",
-                    description: t("idpOidcDescription")
+                    description: t("idpOidcDescription"),
+                    icon: <IdpTypeIcon type="oidc" size={24} />
                 }
             ];
             if (hideTemplates) {
@@ -44,29 +45,13 @@ export function OidcIdpProviderTypeSelect({ value, onTypeChange }: Props) {
                     id: "google",
                     title: t("idpGoogleTitle"),
                     description: t("idpGoogleDescription"),
-                    icon: (
-                        <Image
-                            src="/idp/google.png"
-                            alt={t("idpGoogleAlt")}
-                            width={24}
-                            height={24}
-                            className="rounded"
-                        />
-                    )
+                    icon: <IdpTypeIcon type="google" size={24} />
                 },
                 {
                     id: "azure",
                     title: t("idpAzureTitle"),
                     description: t("idpAzureDescription"),
-                    icon: (
-                        <Image
-                            src="/idp/azure.png"
-                            alt={t("idpAzureAlt")}
-                            width={24}
-                            height={24}
-                            className="rounded"
-                        />
-                    )
+                    icon: <IdpTypeIcon type="azure" size={24} />
                 }
             ];
         }, [hideTemplates, t]);

src/components/ui/controlled-data-table.tsx

@@ -18,12 +18,14 @@ import {
     TableRow
 } from "@/components/ui/table";
 import { DataTablePagination } from "@app/components/DataTablePagination";
+import type { DataTableAddAction } from "@app/components/ui/data-table";
 import { Button } from "@app/components/ui/button";
 import { Card, CardContent, CardHeader } from "@app/components/ui/card";
 import {
     DropdownMenu,
     DropdownMenuCheckboxItem,
     DropdownMenuContent,
+    DropdownMenuItem,
     DropdownMenuLabel,
     DropdownMenuSeparator,
     DropdownMenuTrigger
@@ -31,7 +33,14 @@ import {
 import { Input } from "@app/components/ui/input";
 import { useStoredColumnVisibility } from "@app/hooks/useStoredColumnVisibility";
 
-import { Columns, Filter, Plus, RefreshCw, Search } from "lucide-react";
+import {
+    ChevronDown,
+    Columns,
+    Filter,
+    Plus,
+    RefreshCw,
+    Search
+} from "lucide-react";
 import { useTranslations } from "next-intl";
 import { useMemo, useState } from "react";
 
@@ -67,6 +76,8 @@ type ControlledDataTableProps<TData, TValue> = {
     tableId: string;
     addButtonText?: string;
     onAdd?: () => void;
+    addActions?: DataTableAddAction[];
+    addButtonDisabled?: boolean;
     onRefresh?: () => void;
     isRefreshing?: boolean;
     refreshButtonDisabled?: boolean;
@@ -90,6 +101,8 @@ export function ControlledDataTable<TData, TValue>({
     rows,
     addButtonText,
     onAdd,
+    addActions,
+    addButtonDisabled = false,
     onRefresh,
     isRefreshing,
     refreshButtonDisabled = false,
@@ -348,16 +361,49 @@ export function ControlledDataTable<TData, TValue>({
                                 </Button>
                             </div>
                         )}
-                        {onAdd && addButtonText && (
+                        {addActions && addActions.length > 0 && addButtonText ? (
                             <div>
-                                <Button
-                                    onClick={onAdd}
-                                    loading={isNavigatingToAddPage}
-                                >
-                                    <Plus className="mr-2 h-4 w-4" />
-                                    {addButtonText}
-                                </Button>
+                                <DropdownMenu>
+                                    <DropdownMenuTrigger asChild>
+                                        <Button
+                                            disabled={
+                                                addButtonDisabled ||
+                                                isNavigatingToAddPage
+                                            }
+                                        >
+                                            <Plus className="mr-2 h-4 w-4" />
+                                            {addButtonText}
+                                            <ChevronDown className="ml-2 h-4 w-4" />
+                                        </Button>
+                                    </DropdownMenuTrigger>
+                                    <DropdownMenuContent align="end">
+                                        {addActions.map((action, i) => (
+                                            <DropdownMenuItem
+                                                key={i}
+                                                onSelect={() =>
+                                                    action.onSelect()
+                                                }
+                                            >
+                                                {action.label}
+                                            </DropdownMenuItem>
+                                        ))}
+                                    </DropdownMenuContent>
+                                </DropdownMenu>
                             </div>
+                        ) : (
+                            onAdd &&
+                            addButtonText && (
+                                <div>
+                                    <Button
+                                        onClick={onAdd}
+                                        loading={isNavigatingToAddPage}
+                                        disabled={addButtonDisabled}
+                                    >
+                                        <Plus className="mr-2 h-4 w-4" />
+                                        {addButtonText}
+                                    </Button>
+                                </div>
+                            )
                         )}
                     </div>
                 </CardHeader>

src/components/ui/data-table.tsx

@@ -33,7 +33,7 @@ import { Button } from "@app/components/ui/button";
 import { useEffect, useMemo, useRef, useState } from "react";
 import { Input } from "@app/components/ui/input";
 import { DataTablePagination } from "@app/components/DataTablePagination";
-import { Plus, Search, RefreshCw, Columns, Filter } from "lucide-react";
+import { ChevronDown, Plus, Search, RefreshCw, Columns, Filter } from "lucide-react";
 import {
     Card,
     CardContent,
@@ -46,6 +46,7 @@ import {
     DropdownMenu,
     DropdownMenuCheckboxItem,
     DropdownMenuContent,
+    DropdownMenuItem,
     DropdownMenuLabel,
     DropdownMenuSeparator,
     DropdownMenuTrigger
@@ -165,12 +166,20 @@ export type DataTablePaginationState = PaginationState & {
 
 export type DataTablePaginationUpdateFn = (newPage: PaginationState) => void;
 
+/** When set (non-empty), replaces the single add button with a dropdown; `onAdd` is not used. */
+export type DataTableAddAction = {
+    label: string;
+    onSelect: () => void;
+};
+
 type DataTableProps<TData, TValue> = {
     columns: ExtendedColumnDef<TData, TValue>[];
     data: TData[];
     title?: string;
     addButtonText?: string;
     onAdd?: () => void;
+    /** Prefer over `onAdd` when non-empty. */
+    addActions?: DataTableAddAction[];
     addButtonDisabled?: boolean;
     onRefresh?: () => void;
     isRefreshing?: boolean;
@@ -205,6 +214,7 @@ export function DataTable<TData, TValue>({
     title,
     addButtonText,
     onAdd,
+    addActions,
     addButtonDisabled = false,
     onRefresh,
     isRefreshing,
@@ -637,13 +647,45 @@ export function DataTable<TData, TValue>({
                                 </Button>
                             </div>
                         )}
-                        {onAdd && addButtonText && (
+                        {addActions && addActions.length > 0 && addButtonText ? (
                             <div>
-                                <Button onClick={onAdd} disabled={addButtonDisabled}>
-                                    <Plus className="mr-2 h-4 w-4" />
-                                    {addButtonText}
-                                </Button>
+                                <DropdownMenu>
+                                    <DropdownMenuTrigger asChild>
+                                        <Button
+                                            disabled={addButtonDisabled}
+                                        >
+                                            <Plus className="mr-2 h-4 w-4" />
+                                            {addButtonText}
+                                            <ChevronDown className="ml-2 h-4 w-4" />
+                                        </Button>
+                                    </DropdownMenuTrigger>
+                                    <DropdownMenuContent align="end">
+                                        {addActions.map((action, i) => (
+                                            <DropdownMenuItem
+                                                key={i}
+                                                onSelect={() =>
+                                                    action.onSelect()
+                                                }
+                                            >
+                                                {action.label}
+                                            </DropdownMenuItem>
+                                        ))}
+                                    </DropdownMenuContent>
+                                </DropdownMenu>
                             </div>
+                        ) : (
+                            onAdd &&
+                            addButtonText && (
+                                <div>
+                                    <Button
+                                        onClick={onAdd}
+                                        disabled={addButtonDisabled}
+                                    >
+                                        <Plus className="mr-2 h-4 w-4" />
+                                        {addButtonText}
+                                    </Button>
+                                </div>
+                            )
                         )}
                     </div>
                 </CardHeader>