# SSO & SCIM block

> Enterprise SSO and SCIM Security Settings Page with Policy Controls

Workspace admin page to manage SSO providers, SCIM provisioning, 2FA and password policy, session timeouts, and allowed domains, with status rows and a dirty-state save bar. ReUI Frame, Alert, Badge; shadcn Button, Select, Switch. Security settings.

- Type: Pro block
- Category: [Users](https://web.dev.reui.io/blocks/solutions/users.md)
- Page: https://web.dev.reui.io/blocks/solutions/users/solution-users-7
- MCP: `get_block("solution-users-7")`
- Built with: Alert, Badge, Button, Dropdown Menu, Field, Frame, Input Group, Item, Select, Separator, Switch, Tooltip
- Installs with a ReUI Pro or Ultimate license; setup: https://web.dev.reui.io/docs/license-setup

## Best for

Identity provider rows with a Test action, a masked SCIM token to reveal or rotate, and a View as Member mode that disables each section

## Agent notes

- `PROVIDERS`, `SCIM_ENDPOINT` and `SCIM_TOKEN` are sample values to replace, and the token is a plain client constant
- `handleTest`, `handleRotate` and `handleSave` do nothing beyond local state and a `showSecurityToast` message; `SCIM_TOKEN` stays the same after a rotate
- The Add domain button has no `onClick`, so `ALLOWED_DOMAINS` never grows; only the `domainError` check runs while typing

## When not to use

- A person changing their own password and reviewing their own sessions: use [Account Settings](https://web.dev.reui.io/blocks/application/settings/settings-7.md) (`get_block("settings-7")`)
- Third party app connections grouped into sections with a status per row: use [App Connections](https://web.dev.reui.io/blocks/application/settings/settings-4.md) (`get_block("settings-4")`)

## Third-party libraries

- Sonner v2: [API reference](https://sonner.emilkowal.ski/toast), [docs](https://sonner.emilkowal.ski/getting-started)

## Install

```bash
npx shadcn@latest add @reui/solution-users-7
```

## About Users blocks

### When to use

- Workspace admin pages for people: a members directory, one member's record and the invitations queue
- Access control work: a role by permission matrix, just in time access requests and a day grouped audit log
- Enterprise sign-in settings for SSO providers, SCIM provisioning, 2FA, session limits and email domains

### When not to use

- A person editing their own account: avatar, name, email, password and notification choices: use the [Profile blocks](https://web.dev.reui.io/blocks/application/profile.md)
- A table section of your own records, with no roles, sign-in methods or invites around it: use the [Base blocks](https://web.dev.reui.io/blocks/data-grid/base.md)
- Notification, appearance or integration options, with no people or SSO to manage: use the [Settings blocks](https://web.dev.reui.io/blocks/application/settings.md)

### Agent notes

- Every page.tsx sets a padded `min-h-svh` wrapper, and page.tsx or the root caps the max width; drop both inside your app shell
- Feedback goes through sonner `toast` and no block mounts a Toaster, so render one in your layout or no message appears
- No block sends a request or writes storage: state sits in `useState` or uncontrolled inputs, so every change resets on reload

Every ReUI item has a twin like this one; the index is https://web.dev.reui.io/llms.txt. Agents with the ReUI MCP (https://web.dev.reui.io/docs/mcp) get the same guidance from the getters named above.