Configure Supabase enterprise SSO, role-based access control, and organization management. Use when implementing SSO integration, configuring role-based permissions, or setting up organization-level controls for Supabase. Trigger with phrases like "supabase SSO", "supabase RBAC", "supabase enterprise", "supabase roles", "supabase permissions", "supabase SAML".
/plugin marketplace add jeremylongshore/claude-code-plugins-plus-skills/plugin install supabase-pack@claude-code-plugins-plusThis skill is limited to using the following tools:
Configure enterprise-grade access control for Supabase integrations.
| Role | Permissions | Use Case |
|---|---|---|
| Admin | Full access | Platform administrators |
| Developer | Read/write, no delete | Active development |
| Viewer | Read-only | Stakeholders, auditors |
| Service | API access only | Automated systems |
enum SupabaseRole {
Admin = 'admin',
Developer = 'developer',
Viewer = 'viewer',
Service = 'service',
}
interface SupabasePermissions {
read: boolean;
write: boolean;
delete: boolean;
admin: boolean;
}
const ROLE_PERMISSIONS: Record<SupabaseRole, SupabasePermissions> = {
admin: { read: true, write: true, delete: true, admin: true },
developer: { read: true, write: true, delete: false, admin: false },
viewer: { read: true, write: false, delete: false, admin: false },
service: { read: true, write: true, delete: false, admin: false },
};
function checkPermission(
role: SupabaseRole,
action: keyof SupabasePermissions
): boolean {
return ROLE_PERMISSIONS[role][action];
}
// Supabase SAML setup
const samlConfig = {
entryPoint: 'https://idp.company.com/saml/sso',
issuer: 'https://supabase.com/saml/metadata',
cert: process.env.SAML_CERT,
callbackUrl: 'https://app.yourcompany.com/auth/supabase/callback',
};
// Map IdP groups to Supabase roles
const groupRoleMapping: Record<string, SupabaseRole> = {
'Engineering': SupabaseRole.Developer,
'Platform-Admins': SupabaseRole.Admin,
'Data-Team': SupabaseRole.Viewer,
};
import { OAuth2Client } from '@supabase/supabase-js';
const oauthClient = new OAuth2Client({
clientId: process.env.SUPABASE_OAUTH_CLIENT_ID!,
clientSecret: process.env.SUPABASE_OAUTH_CLIENT_SECRET!,
redirectUri: 'https://app.yourcompany.com/auth/supabase/callback',
scopes: read, write, realtime,
});
interface SupabaseOrganization {
id: string;
name: string;
ssoEnabled: boolean;
enforceSso: boolean;
allowedDomains: string[];
defaultRole: SupabaseRole;
}
async function createOrganization(
config: SupabaseOrganization
): Promise<void> {
await supabaseClient.organizations.create({
...config,
settings: {
sso: {
enabled: config.ssoEnabled,
enforced: config.enforceSso,
domains: config.allowedDomains,
},
},
});
}
function requireSupabasePermission(
requiredPermission: keyof SupabasePermissions
) {
return async (req: Request, res: Response, next: NextFunction) => {
const user = req.user as { supabaseRole: SupabaseRole };
if (!checkPermission(user.supabaseRole, requiredPermission)) {
return res.status(403).json({
error: 'Forbidden',
message: `Missing permission: ${requiredPermission}`,
});
}
next();
};
}
// Usage
app.delete('/supabase/resource/:id',
requireSupabasePermission('delete'),
deleteResourceHandler
);
interface SupabaseAuditEntry {
timestamp: Date;
userId: string;
role: SupabaseRole;
action: string;
resource: string;
success: boolean;
ipAddress: string;
}
async function logSupabaseAccess(entry: SupabaseAuditEntry): Promise<void> {
await auditDb.insert(entry);
// Alert on suspicious activity
if (entry.action === 'delete' && !entry.success) {
await alertOnSuspiciousActivity(entry);
}
}
Map organizational roles to Supabase permissions.
Set up SAML or OIDC integration with your IdP.
Add permission checks to API endpoints.
Track all access for compliance.
| Issue | Cause | Solution |
|---|---|---|
| SSO login fails | Wrong callback URL | Verify IdP config |
| Permission denied | Missing role mapping | Update group mappings |
| Token expired | Short TTL | Refresh token logic |
| Audit gaps | Async logging failed | Check log pipeline |
if (!checkPermission(user.role, 'write')) {
throw new ForbiddenError('Write permission required');
}
For major migrations, see supabase-migration-deep-dive.