Workspace SSO / Session & Refresh Triage

Customers often interpret any full IdP round-trip as a “bug.” Many cases are expected: a new browser or device always needs a new SSO sign-in, and refresh token expiry (workspace-scoped) forces re-login on an existing device after the configured lifetime—even when the IdP session is still valid.

This skill separates working-as-intended session behavior from true SSO misconfiguration, refresh failures, or IdP policy forcing re-auth.

When to Use

• Report: user is prompted for SSO / IdP login more often than they expect
• Symptoms: “frequent login,” “keeps asking me to sign in,” “session doesn’t stick”
• You have {workspace_id}, user email, and cluster (e.g. IN, US, EU)
• You need to explain why logins occurred on specific dates (timeline triage)

Do Not Use

• Google OAuth redirect_uri_mismatch before Google returns to SpotDraft → use google-oauth-redirect-uri-mismatch
• Login never succeeds or only some users fail at callback with 4xx/5xx → treat as SSO config or app error, not “frequent prompt”
• Counterparty-only flows (different refresh rules) → confirm RefreshTokenService counterparty branch in code
• Pure access-token expiry with silent refresh working (user not sent to IdP) → usually not this playbook