Add SAML Setup

[twisterdotcom]

Design Doc HERE

Proposal

Proposal: Add SAML configuration to New Expensify

Problem: Last year we added user SAML SSO last year to newDot to allow access to Expensify for controlled users on SAML Required domains, but SAML configuration currently still lives solely in Expensify Classic Domains > SAML settings, meaning any #wave-control domain admin needing to setup, or make requirement and certificate changes is still required to follow the Switch to Expensify Classic flow to configure SAML for their organization.

SAML is also often the major selling point for higher subscription costs in Enterprise SaaS software for all of the benefits it brings and not supporting it's setup in New Expensify means we lose the ability to sell Expensify with those benefits for customers willing to pay top dollar:

• Enhanced Security: Centralized authentication, reduced phishing risk, and support for MFA (also good for us!)
• Improved User Experience: One login for multiple apps and faster access.
• Compliance and Auditing: Audit trails and standardized protocol for easier compliance.
• Reduced IT Support Burden: Fewer password resets and simplified integration.
• Scalability: Easier onboarding and enterprise readiness.
• Increased Adoption: Seamless login experience and enterprise appeal.

Solution:

Let's add SAML configuration to New Expensify and possibly fix some long-standing bugs in the process. Some fun discussions surely to be had on where/how we add this domain feature into NewDot during the predesign.

Slack: https://expensify.slack.com/archives/CC7NECV4L/p1724103770176439

Tasks

• [x] Post Proposal (full Problem/Solution statement) in #expensify-open-source
• [x] Wait at least one full business day, and until the post has a majority (2/3) of positive reactions (👍)
• [x] Paste Proposal in the space above with a link to the Slack thread
• [x] Email strategy@expensify.com and paste in the Proposal
• [ ] Fill out the High-level overview of the problem, Timeline, and Terminology sections of the Design Doc
• [ ] Email strategy@expensify.com (continue the same email chain as before) with the link to your Design Doc
• [ ] Host a pre-design meeting (example) in #expensify-open-source to discuss any necessary details in public before filling out the High-level of proposed solution section.
• [ ] Fill out the High-level of proposed solution section
• [ ] Email stategy@expensify.com again with links to the doc and pre-design conversation in Slack
• [ ] Add the DesignDocReview label to get the High-level of proposed solution section reviewed
• [ ] Respond to any questions or concerns and bring up blockers in Slack to get a consensus if necessary
• [ ] Confirm that the doc has the minimum necessary number of reviews before proceeding
• [ ] Host another pre-design meeting in #expensify-open-source to ask for engineering feedback on the technical solution.
• [ ] Fill out the Detailed implementation of the solution and related sections.
• [ ] Re-add the DesignDocReview label to this issue
• [ ] Respond to any questions or concerns and bring up blockers in Slack to get consensus if necessary
• [ ] Confirm that the doc has the minimum necessary number of reviews before proceeding
• [ ] Email strategy@expensify.com one last time to let them know the Design Doc is moving into the implementation phase
• [ ] Implement the changes
• [ ] Add regression tests so that QA can test your feature with every deploy (instructions)
• [ ] Send out a follow up email to strategy@expensify.com once everything has been implemented and do a Project Wrap-Up retrospective that provides:
  • Summary of what we accomplished with this project
  • What went well?
  • What could we have done better?
  • What did we learn?

[melvin-bot[bot]]

Current assignee @twisterdotcom is eligible for the NewFeature assigner, not assigning anyone new.

[melvin-bot[bot]]

:warning: It looks like this issue is labelled as a New Feature but not tied to any GitHub Project. Keep in mind that all new features should be tied to GitHub Projects in order to properly track external CAP software time :warning:

[melvin-bot[bot]]

Triggered auto assignment to Design team member for new feature review - @dubielzyk-expensify (NewFeature)

[dubielzyk-expensify]

Let's do it 💪

[dubielzyk-expensify]

Let me know if you need anything to get started with this :)

[twisterdotcom]

Throwing this here just as a note about services that basically charge more because they have this:

[twisterdotcom]

[twisterdotcom]

Doc: https://docs.google.com/document/d/1JP7Tx6g0vPf4mKHzWDeHf5XoAzzw9hNhokNUIJ5Kf9M/edit?usp=sharing

[twisterdotcom]

Headed OOO for a bit. Will pick this up when I'm back.

[twisterdotcom]

Predesign here: https://expensify.slack.com/archives/C06ML6X0W9L/p1725445965797999

[twisterdotcom]

Okay @dubielzyk-expensify, I'll hopefully be looking to post some final screens next week and get the doc out. @dannymcclain has been pretty active here: https://expensify.slack.com/archives/C06ML6X0W9L/p1725446027972499, so not sure if you want to swap out, or if you're fine taking over and we can have a sync early next week? I should be around Monday now I think.