fix: correct social sign-in, enterprise SSO, and directory sync integrations

[jhickmanit]

Corrects the social sign-in, enterprise SSO, generic protocol, government identity, directory sync, and agent identity integrations so their configuration matches what Ory Network accepts and the provider documentation on ory.com/docs.

Changes

• Social sign-in:
  • Battle.net and Kakao use the generic OIDC provider with the vendor issuer and a null-safe mapper.
  • Naver and TikTok describe an OAuth2-to-OIDC bridge. Ory's generic provider uses discovery only and ignores explicit endpoints.
  • Telegram uses its native OIDC issuer with pkce: force.
  • Slack, Spotify, Discord, Patreon, Lark, Twitch, LINE, and GitHub App list only the scopes and claims Ory receives.
  • UAE PASS and Amazon register the /oidc/callback redirect URI, without the provider ID, because they force PKCE.
  • Steam and WeChat no longer describe minting sessions through the Admin API or pointing the generic provider at non-OIDC endpoints.
• Enterprise SSO and generic protocols: every page lists the Ory Network connection values: ACS URL and SP entity ID for SAML, and the organization redirect URI for OIDC. The Keycloak redirect URI is corrected, and IdP-initiated SAML is described as supported but off by default. The Okta console-steps mapper no longer fails when given_name is missing.
• Directory sync:
  • BambooHR changes behavior. Its handler returns 204 for active employees and 403 with a Kratos messages body otherwise. Before, it returned 200 and never blocked a sign-in.
  • JumpCloud, OneLogin, and Workday document the Ory Network SCIM client path.
• Agent identity: Skyfire and Tetrate model agents as OAuth2 clients.
• Government identity: Aadhaar hook placement and the eIDAS aal2_acr_values and LoA URIs are corrected.

Deployment notes

• BambooHR fails closed: when BambooHR is unreachable, the handler returns 502, which blocks sign-in. Change this if you need fail-open behavior.
• Telegram still ships the legacy widget validator. A full OIDC bridge is out of scope.

Validation

• Every Jsonnet mapper rendered with go-jsonnet 0.21 against missing, null, and populated claims.
• Battle.net, Kakao, Telegram, Naver, and Epic Games discovery documents were fetched live.
• The BambooHR and Telegram handlers pass tsc --noEmit, and all registry entries parse.
• Not verified: logins against real vendor accounts.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d56380b9-f26a-4094-bf07-6e217a831b63

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}