feat(internet-identity): SSO sign-in and the SSO domain status on auth 11 by sea-snake · Pull Request #415 · dfinity/icskills

sea-snake · 2026-10-07T09:49:26Z

Brings the internet-identity skill in line with the Internet Identity guides in the developer docs and with @icp-sdk/auth 11.

Organization SSO: constructor-only ssoDomain (mutually exclusive with openIdProvider), the domain check as client state (getSsoStatus() with subscribe(), refreshSsoStatus() to retry, dispose() for a replaced client), signIn() rejecting only for an invalid domain, and sso: scoped keys. New pitfalls: no browser-side domain check, no awaiting the check before signIn(), and options being constructor-only.
Corrections: verified_email is present when an OpenID provider marked the address verified or the user verified it with Internet Identity, and never under sso:; mo:identity-attributes reads SSO email from sso:<domain>:email.
Less duplication: the shared-sessions walkthrough, the full app-metadata rules, the organization's SSO setup, the Rust attributes backend and the older-API notes are replaced by links to the developer-docs guides and the @icp-sdk/auth upgrade guides. SKILL.md goes from 768 to 391 lines.
Versions: pins @icp-sdk/auth@^11 with @icp-sdk/core@^6.

Describes dfinity/developer-docs#340, dfinity/icp-js-auth#203 and dfinity/internet-identity#4421.

Evals: three SSO cases added and the changed cases re-run with and without the skill (SSO check while typing 6/6 vs 1/6, awaiting the check 3/3 vs 2/3, verified_email under sso: 4/4 vs 2/4, local II without agentOptions 5/5 vs 3/5, version pairing 4/4 vs 3/4); trigger evals 9/9 and 6/6. node scripts/check-project.js passes.

🤖 Generated with Claude Code

…h 11 Adds organization SSO: constructor-only `ssoDomain`, the domain check as client state (`getSsoStatus()` with `subscribe()`, `refreshSsoStatus()` to retry), `signIn()` rejecting only for an invalid domain, and `sso:` scoped keys. Corrects `verified_email` (an OpenID provider's verification or one the user completed with II, never under `sso:`) and the `mo:identity-attributes` mapping for SSO sources. SKILL.md moves under the 500-line limit: the shared-sessions walkthrough, the app-metadata rules, the Rust attributes backend, the older-API notes, and the organization's SSO setup move to `references/`. Pins `@icp-sdk/auth@^11` with `@icp-sdk/core@^6`; evals updated and three SSO cases added. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

… asks Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

The shared-sessions walkthrough, app-metadata rules, organization SSO setup, Rust attributes backend and older-API notes live in the developer docs and the @icp-sdk/auth upgrade guides; the skill links to them. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

github-actions · 2026-10-07T09:49:48Z

Skill Validation Report

Validating skill: /home/runner/work/icskills/icskills/skills/internet-identity

Structure

Pass: SKILL.md found
Pass: all files in references/ are referenced

Frontmatter

Pass: name: "internet-identity" (valid)
Pass: description: (609 chars)
Pass: license: "Apache-2.0"
Pass: compatibility: (45 chars)
Pass: metadata: (2 entries)

Tokens

Warning: SKILL.md body is 6090 tokens (spec recommends < 5000)

Markdown

Pass: no unclosed code fences found

Tokens

File	Tokens
SKILL.md body	6,090
references/app-metadata.md	1,030
references/enterprise-sso.md	1,218
references/older-api.md	753
references/rust-identity-attributes.md	884
references/shared-sessions.md	1,204
Total	11,179

Content Analysis

Metric	Value
Word count	3,331
Code block ratio	0.22
Imperative ratio	0.07
Information density	0.14
Instruction specificity	0.88
Sections	15
List items	40
Code blocks	14

References Content Analysis

Metric	Value
Word count	3,005
Code block ratio	0.11
Imperative ratio	0.01
Information density	0.06
Instruction specificity	0.89
Sections	19
List items	38
Code blocks	13

Contamination Analysis

Metric	Value
Contamination level	low
Contamination score	0.11
Primary language category	javascript
Scope breadth	3

Warning: Language mismatch: config (1 category differ from primary)

References Contamination Analysis

Metric	Value
Contamination level	high
Contamination score	0.60
Primary language category	config
Scope breadth	5

Warning: Language mismatch: javascript, shell, systems (3 categories differ from primary)
Multi-interface tool detected: aws

Result: 1 warning

Project Checks


✓ Project checks passed for 1 skills (0 warnings)

Copilot

Copilot review overview

🟡 Changes recommended

Several examples can produce unhandled rejections or fail locally, and related evaluation expectations need correction.

Review effort: Balanced
Findings: 5

Open (5)

Test rejection handling separately from synchronous invocation · New
Clarify domain gating versus ordinary sign-in promise failures · New
Handle rejected signIn promise in the click handler · New
Pass rootKey to both identity-attributes agents · New
Import scopedKeys from the client submodule · New

What changed in this PR

Updates the Internet Identity skill for @icp-sdk/auth 11, including organization SSO and revised identity-attribute guidance.

Changes:

Documents SSO domain checking, lifecycle, and sign-in behavior.
Updates versions, attribute semantics, and related evaluations.
Replaces duplicated walkthroughs with developer-guide links.

File	Description
`skills/internet-identity/SKILL.md`	Updates and condenses Internet Identity guidance.
`evaluations/internet-identity.json`	Adds SSO cases and updates version expectations.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

… key Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Copilot

Copilot review overview

🔵 Needs a closer look

It contains outdated Vite guidance, contradictory local-II documentation, and uncovered SSO behaviors.

Review effort: Balanced
Findings: None

Resolved since last review (5)

Import scopedKeys from the client submodule
Pass rootKey to both identity-attributes agents
Handle rejected signIn promise in the click handler
Clarify domain gating versus ordinary sign-in promise failures
Test rejection handling separately from synchronous invocation

Previously missed (3)

In code that hasn't changed since last review

Add eval coverage for constructor-only SSO domain changes

skills/internet-identity/SKILL.md:93

This newly added constructor-only pitfall has no output eval, although the other two new SSO pitfalls do. Add a focused case that rejects attempts to change ssoDomain or pass it to signIn(), and requires disposing and replacing the client; otherwise this explicit regression target is unprotected.

This issue also appears on line 224 of the same file.

Update outdated Vite target default claim

skills/internet-identity/SKILL.md:47

This Vite default is outdated: skills/wallet-integration/SKILL.md:430 records that only Vite 5 and earlier defaulted to es2020, while Vite 6+ uses baseline-widely-available and allows top-level await. Keep the portable init() recommendation, but version the claim so current users are not given an incorrect explanation.

This issue also appears on line 157 of the same file.

Remove unnecessary second local principal instruction

skills/internet-identity/SKILL.md:350

This instruction contradicts lines 39 and 108, which state that the local II uses the same well-known backend principal. For the ii: true setup documented here, adding another local principal is unnecessary and implies readers need to discover a second ID.

…tProfile, and cover constructor-only ssoDomain Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

sea-snake · 2026-10-07T10:28:12Z

On the three items Copilot lists under "previously missed", all fixed in a4fcab4:

Constructor-only ssoDomain had no output eval: added "Adversarial: switching an existing client to another SSO domain".
The Vite default: the skill now says Vite 6 and earlier reject top-level await by default and Vite 7 allows it, and keeps the init() recommendation.
The local II principal: the trusted_attribute_signers comment now says a local II (ii: true) has the same principal.

The same commit also makes the Motoko getProfile example read caller from the call instead of taking a principal argument.

Copilot

Copilot review overview

🟢 Approval recommended

The documentation and evaluations are consistent, focused, and syntactically valid.

Review effort: Balanced
Findings: None

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Restores the reference files and brings them to the current state: the Rust backend from the developer docs (bounded nonces, ic-cdk-management-canister), one client per page in shared sessions, a domain without a port, and no asset canister setup. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…st backend, and keep the profile lookup public Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

sea-snake and others added 3 commits October 7, 2026 11:38

test(internet-identity): scope the SSO verified_email eval to what it…

ef61a6e

… asks Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

sea-snake requested a balanced review from Copilot October 7, 2026 09:49

Copilot started reviewing on behalf of sea-snake October 7, 2026 09:50 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

Comment thread evaluations/internet-identity.json Outdated

Comment thread skills/internet-identity/SKILL.md Outdated

Comment thread skills/internet-identity/SKILL.md Outdated

Comment thread skills/internet-identity/SKILL.md Outdated

Comment thread skills/internet-identity/SKILL.md Outdated

fix(internet-identity): handle signIn() rejections and the local root…

79cea81

… key Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

sea-snake requested a balanced review from Copilot October 7, 2026 10:21

Copilot started reviewing on behalf of sea-snake October 7, 2026 10:22 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

fix(internet-identity): version the Vite claim, read the caller in ge…

a4fcab4

…tProfile, and cover constructor-only ssoDomain Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

sea-snake requested a balanced review from Copilot October 7, 2026 10:28

Copilot started reviewing on behalf of sea-snake October 7, 2026 10:29 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

sea-snake and others added 8 commits October 7, 2026 13:42

docs(internet-identity): drop the asset canister note

d26a6c2

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs(internet-identity): drop the links to the human docs

8daa0d3

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs(internet-identity): drop the server-rendering note

f106af8

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs(internet-identity): debounce the SSO domain input

3c7dc68

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs(internet-identity): use the identity-attributes crate for the Ru…

3a2a0d1

…st backend, and keep the profile lookup public Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs(internet-identity): name the profile lookup's argument userId

fcb177a

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs(internet-identity): say the Rust example keeps profiles on the heap

cd7ad71

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

sea-snake marked this pull request as ready for review October 7, 2026 13:59

sea-snake requested review from a team and JoshDFN as code owners October 7, 2026 13:59

Navigation Menu

Repository navigation

feat(internet-identity): SSO sign-in and the SSO domain status on auth 11 - #415

feat(internet-identity): SSO sign-in and the SSO domain status on auth 11#415
sea-snake wants to merge 13 commits into
mainfrom
docs/internet-identity-sso

sea-snake commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

sea-snake commented Oct 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

sea-snake commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Skill Validation Report

Validating skill: /home/runner/work/icskills/icskills/skills/internet-identity

Structure

Frontmatter

Tokens

Markdown

Tokens

Content Analysis

References Content Analysis

Contamination Analysis

References Contamination Analysis

Project Checks

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

sea-snake commented Oct 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Oct 7, 2026 •

edited

Loading