feat(sso): add configure_auth_type to enable or disable an SSO configuration

[dorsha]

Description

Wraps the new management endpoint POST /v1/mgmt/sso/settings/authtype

# disable one connection of a multi-SSO tenant, keeping its configuration
descope_client.mgmt.sso.configure_auth_type("tenant-id", "none", sso_id="conf1")
# enable it again on the protocol it is configured for
descope_client.mgmt.sso.configure_auth_type("tenant-id", "saml", sso_id="conf1")
# omit sso_id to target the tenant's default configuration
descope_client.mgmt.sso.configure_auth_type("tenant-id", "none")

Why. A customer running their own admin UI on the management APIs needs to temporarily disable one SSO connection of a multi-SSO tenant. Until now the only per-connection off switch was delete_settings, which drops the connection: re-enabling meant new_settings plus a full configure_saml_settings / configure_oidc_settings replay, with the caller storing the mappings, the domains and the OIDC client secret (never returned on read). For SAML it was worse, since a recreated connection gets a new ACS URL and the tenant's IdP admin has to reconfigure. configure_auth_type leaves the stored configuration intact, so re-enabling needs no payload.

Body composition sits in _sso_settings_base.py with thin sync and async methods, matching configure_xaa_settings.

Second commit — delete_settings accepts sso_id. It previously sent only tenantId, so it could only delete a tenant's default configuration and a multi-SSO tenant's additional configurations were unreachable from this SDK. The node and go SDKs already pass ssoId through. Optional keyword, so existing calls are unaffected.

descope_client.mgmt.sso.delete_settings("tenant-id", sso_id="conf1")

Tests

• test_configure_auth_type — the failure path, the request body with an sso_id, and the default-configuration call that omits it.
• test_delete_settings — extended with the specific-configuration case asserting ssoId reaches the query params.

Both run in sync and async modes. Full suite: 1084 passed, 26 skipped. ruff check and ruff format --check clean.

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

This PR introduces a new SSO configuration endpoint wrapper (configure_auth_type) that spans multiple SSO-related modules and includes test coverage. The review strategy prioritizes contributors with deep expertise in the modified areas: (1) LioriE for core SSO settings implementation and architecture, (2) omercnet for test coverage and SSO settings logic, and (3) chris4490 for common utilities and documentation consistency. This combination ensures thorough coverage across the business logic, testing practices, and user-facing documentation.

Reviewer	Reason
LioriE	Highest expertise in SSO settings modules (6 commits across _sso_settings_base.py, sso_settings.py, sso_settings_async.py). Critical for reviewing the new configure_auth_type method implementation and ensuring consistency with existing SSO patterns.
omercnet	Strong track record in both SSO settings logic and test coverage (commits in common.py, sso_settings.py, and test_sso_settings.py). Essential for ensuring tests are comprehensive and implementation aligns with management patterns.
chris4490	Relevant expertise in common.py modifications and README documentation (2 commits). Ensures the utility changes are robust and that documentation is consistent and clear for users.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni Review

Adds configure_auth_type to enable/disable a single SSO configuration's auth type without touching its stored settings, mappings, or domains.

Actionable comments posted: 0

Merge risk: 🟢 Low: body composition and truthy sso_id handling exactly mirror the existing configure_xaa_settings/_compose_configure_xaa_settings_body pattern, endpoint path matches the spec, and the new test covers the failure path plus both sso_id-present and default-configuration cases in sync and async modes.

---

Declared coverage: FULL — 6/6 changed files reviewed.

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Shuni Review

No new issues found.

---

Declared coverage: PARTIAL — 3/6 changed files reviewed.

[github-actions]

Coverage report

The coverage rate went from 98.25% to 98.26% ⬆️

100% of new lines are covered.

Diff Coverage details (click to unfold)

descope/management/common.py

100% of new lines are covered (99.79% of the complete file).

descope/management/sso_settings_async.py

100% of new lines are covered (100% of the complete file).

descope/management/_sso_settings_base.py

100% of new lines are covered (98.85% of the complete file).

descope/management/sso_settings.py

100% of new lines are covered (100% of the complete file).