Fail-closed mapping
Both providers map identities to local accounts fail-closed: the asserted email must already exist as an invited, active user. Nobody is provisioned on first sign-in, and success sets the same session cookie as password login.
Microsoft Entra (OIDC)
Register a web application with redirect URI {origin}/auth/oidc/callback, then set ALCYONE_ENTRA_TENANT_ID, ALCYONE_ENTRA_CLIENT_ID and ALCYONE_ENTRA_CLIENT_SECRET_FILE. The flow is authorization code with PKCE, single-use state and a JWKS-validated id_token; the sign-in page shows the Microsoft button automatically.
SAML 2.0
For Okta, ADFS and other IdPs: upload {origin}/auth/saml/metadata to the IdP, then set ALCYONE_SAML_IDP_SSO_URL and ALCYONE_SAML_IDP_CERT_FILE. Assertions must be signed; unsolicited, replayed, tampered and expired assertions are refused.