From 2c4369159bd42a16b8e66a54b987781b4c6d244d Mon Sep 17 00:00:00 2001
From: Maksim Eltyshev <meltyshev@gmail.com>
Date: Mon, 26 Jan 2026 22:21:27 +0100
Subject: [PATCH] fix: Hide unlinking SSO when OIDC is enforced

---
 .../common/AdministrationModal/UsersPane/ActionsStep.jsx      | 2 +-
 server/api/helpers/users/present-one.js                       | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/client/src/components/common/AdministrationModal/UsersPane/ActionsStep.jsx b/client/src/components/common/AdministrationModal/UsersPane/ActionsStep.jsx
index 16af7266..b5f224a2 100644
--- a/client/src/components/common/AdministrationModal/UsersPane/ActionsStep.jsx
+++ b/client/src/components/common/AdministrationModal/UsersPane/ActionsStep.jsx
@@ -257,7 +257,7 @@ const ActionsStep = React.memo(({ userId, onClose }) => {
               context: 'title',
             })}
           </Menu.Item>
-          {user.isSsoUser && !isCurrentUser && (
+          {user.isSsoUser && !user.lockedFieldNames.includes('isSsoUser') && !isCurrentUser && (
             <Menu.Item className={styles.menuItem} onClick={handleUnlinkSsoClick}>
               <Icon name="unlink" className={styles.menuItemIcon} />
               {t('action.unlinkSso', {
diff --git a/server/api/helpers/users/present-one.js b/server/api/helpers/users/present-one.js
index 31ef9f61..53f00535 100644
--- a/server/api/helpers/users/present-one.js
+++ b/server/api/helpers/users/present-one.js
@@ -70,6 +70,10 @@ module.exports = {
           }
         }
 
+        if (sails.config.custom.oidcEnforced) {
+          lockedFieldNames.push('isSsoUser');
+        }
+
         Object.assign(data, {
           isDefaultAdmin,
           lockedFieldNames,