{"resourceId":"supabase-claude-issued-auth-offboarding-and-issuer-tradeoffs-20261103","versions":[{"version":"external-102f025b87251e7bfb0e84b1b3a9e5e0e942e848f04a8c28647da264f703bbe2","resource":{"id":"supabase-claude-issued-auth-offboarding-and-issuer-tradeoffs-20261103","title":"Supabase: using Claude as identity issuer breaks IdP-based offboarding and can lock out other AI tools that rely on the existing issuer","organization":"Supabase","sector":"Database platform; Claude connector partner","geography":"Global","publishedAt":"November 3, 2026","publicationDate":"2026-11-03","eventDate":"2026-11-03","sourceName":"Supabase blog","sourceLabel":"Partner vendor technical post","sourceUrl":"https://supabase.com/blog/claude-issued-enterprise-managed-auth-for-mcp","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","developers-agents","infrastructure"],"finding":"Supabase describes the Claude-issued enterprise-managed auth flow for its MCP server: after an admin registers Claude's organization issuer URL, members with matching SSO identities connect from Claude without consent screens. Supabase states that Claude checks organization membership but not IdP sign-in, MFA or Supabase rules; that disabling a member in the identity provider no longer cuts off access, so removal is required in both Claude and Supabase; that issued tokens remain valid until expiry; and that replacing the IdP issuer URL with Claude's makes Supabase reject assertions from the IdP, including for other AI tools. Supabase says Okta was the only IdP supporting the extension at launch.","sledRelevance":"Relevant to university research computing and state or municipal developer teams using Supabase or similar MCP-connected platforms with Claude. The constraints are the transferable lesson: adopting Claude as issuer changes offboarding and can break other AI integrations. Why now: published Nov. 3 alongside the Claude auto-connect beta.","evidence":"Vendor technical description; no measured results.","architectureImplications":"One issuer per SSO provider in Supabase: choosing Claude displaces the IdP issuer for all MCP clients.","governanceImplications":"Change control should treat issuer switches as identity architecture changes affecting other tools.","securityPrivacyImplications":"Offboarding no longer flows from the IdP; residual tokens persist until expiry.","caveats":"Specific to Supabase; partner-promotional.","streamIds":["anthropic"],"roles":{"sales":"The sales point is to use Supabase's candor to frame a careful identity conversation. The partner itself says choosing Claude as issuer means IdP offboarding no longer cuts access and other AI tools using the old issuer get rejected. For campus research computing and state dev teams, this supports a scoped architecture review rather than a fast enablement. Do not present Claude-issued auth as a drop-in replacement for an identity provider.","engineering":"The engineering view is that Supabase trusts one issuer per SSO provider, so switching to Claude displaces the IdP issuer for every MCP client. Claude checks membership only; issued tokens live until expiry; removal must happen in both Claude and Supabase. Keep the IdP as issuer where it already supports ID-JAG, and test cross-tool impact before switching.","delivery":"Delivery should gate any issuer switch behind change control involving identity, security and every team using AI tools against the same Supabase organization. Update offboarding runbooks to cover both systems and token expiry windows. Acceptance criteria are proposals."},"roleDetails":{"sales":{"customerProblem":"Developer and research teams want Claude connected to their database platform without per-user consent, but the identity trade-offs are not obvious.","stakeholders":["Research computing director","Application development manager","Identity lead","CISO"],"discoveryQuestions":["Does your IdP already support MCP enterprise-managed authorization?","What other AI tools connect to the same Supabase organization?","How fast must access end after offboarding?"],"valueHypothesis":"Interpretation: smoother Claude access for developers where the IdP cannot issue assertions, with explicit offboarding controls.","potentialEngagement":"An architecture review of MCP authorization choices for one Supabase organization.","unsupportedClaims":["IdP-equivalent security","No impact on other AI tools","Immediate revocation on offboarding"]},"engineering":{"fit":"Supabase organizations with SSO and Claude Team or Enterprise.","architectureIntegration":"Approve Claude in Supabase, register the Claude issuer URL in the ID-JAG Issuer field, test, then set roles and scopes in Claude.","prerequisites":["Supabase SSO configured","Members signed in once via SSO with matching email","Admins in both systems"],"constraints":["One issuer per SSO provider","Rejects IdP-signed assertions after switch","One Supabase organization per issuer URL"],"security":"No MFA or IdP check at assertion time; tokens valid until expiry; dual removal required.","proofOfValue":["Verify other MCP clients still work after switch","Measure time to revoke after removal","Confirm Supabase role inheritance"]},"delivery":{"work":"Assess, then if approved switch issuer in a non-production Supabase organization first.","dependencies":["Identity team","All AI tool owners on the organization","Supabase admin"],"ownership":"Research computing or application platform team","skillsAdoption":"Admins learn ID-JAG issuer setup; none for end users.","governanceCheckpoints":["Change-control approval","Offboarding runbook update","Rollback plan to IdP issuer"],"acceptanceCriteria":["Proposal: no other AI integration breaks in staging test","Proposal: documented revocation within token lifetime"],"risks":["Breaking other AI tools","Residual access after offboarding","Misconfigured issuer across organizations"]}},"retrievedAt":"2026-11-05T04:10:42Z","enrichedAt":"2026-11-05T04:13:07Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Limited.","procurementImplications":"Limited; confirm partner terms for MCP access.","operatingModelImplications":"Identity owners must coordinate with research and dev teams before switching issuers.","sourceVerification":{"openedUrl":"https://supabase.com/blog/claude-issued-enterprise-managed-auth-for-mcp","referenceExcerpt":"To remove a member, remove them from both your Supabase organization and your Claude organization.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}