Break out organization identity providers into its own concepts page - #21105
Break out organization identity providers into its own concepts page#21105jkodroff wants to merge 2 commits into
Conversation
The only documentation of how a Pulumi organization's membership is backed lived at the bottom of the Organizations concepts page, below "Deleting your account," and was never linked from the SAML guides or the version-control integration pages. Adds /docs/administration/concepts/identity-providers/ covering Pulumi, GitHub, GitLab, Bitbucket, and SAML 2.0, with per-provider setup and the prerequisite that members link the new identity before the switch. The Organizations page keeps its heading as a pointer stub so the existing #organization-identity-providers anchor still resolves. Verified against pulumi-service and corrected several claims: the permission is organization:change_backend (admin by default, grantable to a custom role), Bitbucket alone requires workspace admin, only top-level GitLab groups qualify, and "disconnecting" means selecting Pulumi. Fixes #21093 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SfR3RL4KvJeyWjdmAiNfZ5
github-actions
Bot
added
review:triaging
![unblocked[bot]](https://avatars.githubusercontent.com/in/166219?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ No issues found
About Unblocked
Unblocked has been set up to automatically review your team's pull requests to identify genuine bugs and issues.
📖 Documentation — Learn more in our docs.
💬 Ask questions — Mention @unblocked to request a review or summary, or ask follow-up questions.
👍 Give feedback — React to comments with 👍 or 👎 to help us improve.
⚙️ Customize — Adjust settings in your preferences.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Optional style suggestions from the pre-merge review — apply or dismiss; none of them block.
Generated by Claude Code
Pre-merge Review — Last updated 2026-08-24T23:22:19ZTip Summary: This PR lifts the "Organization identity providers" material out of Review confidence:
Investigation log
🔍 Verification trail103 claims extracted · 60 verified · 18 unverifiable · 4 contradicted · 2 framing-drift
Important Please don't hide, resolve, or delete this comment! It breaks things! 📖 How pre-merge review works — the full lifecycle, short-circuits, and escape hatches. |
continued from previous comment
📊 Editorial balanceSingle-subject post; balance check N/A. 🚨 Outstanding in this PRNothing outstanding.
|
github-actions
Bot
added
review:outstanding-issues
…or string
- content/blog/using-pulumi-securely/index.md: "Pulumi Service" -> "Pulumi Cloud"
(style-blocker; line already edited by this PR).
- identity-providers.md L61: drop the quoted error message. Verified against
pulumi-service (cmd/service/api/organizations_backend.go:115), which builds it
as "That %s organization is already registered." with the identity provider
interpolated, so the page's verbatim quote was inaccurate.
- identity-providers.md L73: point "`read:org` scope" at GitHub's public scopes
reference; keep the signed-in settings URL as a separate "review and grant
that access" link.
- organizations.md L54: drop redundant "In addition" ("In addition... you also").
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AtegdZYgiu26EUYhzJ2aJn
github-actions
Bot
added
review:stale
|
@claude #update-review Worked the full worklist (1 blocker, 11 low-confidence, 7 style). Fixes are in Fixed
DisputedNote on evidence class:
Accepted as-is
|
github-actions
Bot
added
review:in-progress
|
🤖 Review updated on @jkodroff's request. |
github-actions
Bot
added
review:no-blockers
2 participants
How a Pulumi organization's membership is backed was documented only at the bottom of the Organizations concepts page, below "Deleting your account," and was never linked from the SAML guides or the version-control integration pages.
Changes
/docs/administration/concepts/identity-providers/covering Pulumi, GitHub, GitLab, Bitbucket, and SAML 2.0 — per-provider setup, the permission required, and the prerequisite that members link the new identity first.## Organization identity providersheading as a pointer stub, so the existing#organization-identity-providersanchor still resolves (it's linked from billing-managers and two blog posts).## Learn moreon the GitHub/GitLab/Bitbucket integration pages; reciprocal link from the SAML guides index.identity-providerspricing row and the dead per-provider anchors in billing-managers, the Cloud FAQ, and two blog posts.Corrections verified against
pulumi-serviceorganization:change_backend— admin by default, but an assignable scope, so a custom role can hold it. The RBAC reference described this scope as "backend infrastructure... advanced configuration and migration," which was wrong.Not asserted: whether GitHub itself requires org-owner approval of the OAuth app. That depends on the GitHub org's third-party access policy and isn't observable from the service source, so the existing hedged wording stands.
Fixes #21093