# Ccc Pro Auth

> SAML, OIDC, and enterprise identity provider scaffolds · Pro tier only

- Skill: `kevinzai/ccc-pro-auth` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kevinzai/ccc-pro-auth`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kevinzai/ccc-pro-auth/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: KevinZai (https://skillmd.com/u/kevinzai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kevinzai/ccc-pro-auth

---


## What this pack will do

- Scaffold SAML 2.0 SP metadata and assertion consumer service handlers
- Wire OIDC Authorization Code flow with PKCE (RFC 7636 compliant)
- Generate Okta integration: app registration, attribute mapping, group sync
- Generate Auth0 integration: tenant config, rules/actions, M2M credentials
- Generate Azure AD / Entra ID integration: app registration, manifest, MSAL config
- Scaffold JIT (just-in-time) user provisioning with conflict resolution
- Add MFA enforcement at the middleware layer (TOTP + WebAuthn)
- Generate role-based access control schema + middleware stubs (RBAC)
- Add session security hardening: rotation, sliding windows, device fingerprinting
- Scaffold SSO test suite: happy path, expired assertion, replayed token, IdP-initiated
- Generate identity provider migration runbook (Okta → Auth0, Auth0 → Cognito, etc.)
- Add passwordless flows: magic link + passkey (WebAuthn Level 2)
- Scaffold OAuth 2.0 client credentials flow for M2M / service accounts
- Wire logout: SLO (Single Logout) for SAML, end_session for OIDC

## Why Pro-only

Enterprise identity patterns require deep, opinionated scaffolding against 6+ IdP vendor APIs — each with its own quirks, SDK versions, and compliance gotchas. The curation and testing burden is high. This pack will save 2–4 weeks of integration work per project.

## Coming in v4.2

This skill is scaffolded. Full implementation ships in v4.2. Sign up at [commanderplugin.com/pro](https://commanderplugin.com/pro) to get notified and receive early access.

## Tier check

This skill checks `isPro()` from `commander/cowork-plugin/lib/license.js` before running. If your license tier is `starter`, it surfaces an upgrade prompt and exits cleanly — no partial scaffolding, no silent failure.

## Reference

- [Pricing and tiers](https://commanderplugin.com/pricing)
- [Free vs Pro comparison](https://commanderplugin.com/free-vs-pro)
- [License activation](/plugin/license-activation)