feat: add the force-enterprise-sso session task

[gabrielmeloc22]

Description

Organizations can require members to authenticate through their enterprise SSO connection before using the organization. The backend expresses this as a new force-enterprise-sso session task (clerk/clerk_go#23030): when such an organization becomes active, at sign-in or on an organization switch, the session stays pending until the user goes through the connection. Clerk components didn't know this task, so users ended up on an empty tasks route or, after switching organization, with a pending session and nothing on screen.

Changes:

• New force-enterprise-sso task in <SignIn /> and <SignUp />. It finds the active organization's SSO connection and starts the existing organization account linking flow (user.createExternalAccount({ enterpriseConnectionId, redirectUrl })). The same button covers the first link and re-authenticating an already linked account. When the user returns from the IdP with the task cleared, the tasks router moves on as usual.
• setActive routes to the task after an organization switch. The switch only becomes pending in the touch response, after the task URL was decided, so <OrganizationSwitcher /> and setActive({ organization }) left the session pending without navigating. It now navigates to taskUrls[key], or the sign-in page's task route, unless a navigate callback is passed.
• Moving between tasks keeps the flow's destination. With path routing, the next task's URL used the finished task's page as redirect_url. When force-enterprise-sso followed choose-organization on a first sign-up, completing it sent the user back to choose-organization, which redirected to itself and left the spinner up.

Not included yet: a standalone <TaskForceEnterpriseSSO /> component, modal <SignIn /> support for the IdP round trip, and showing an error when the SSO attempt fails.

How to test: against a local backend running clerk/clerk_go#23030, enable the force-enterprise-sso instance session task and organization account linking on a SAML connection attached to an organization. Sign in as a member, or switch into the organization, and complete SSO from the task screen.

Checklist

• pnpm test runs as expected. (Ran the clerk-js clerk.test.ts suite and the ui SessionTasks tests, not the full suite.)
• pnpm build runs as expected. (Ran the ui type-check and dev builds of clerk-js and ui.)
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[changeset-bot]

🦋 Changeset detected

Latest commit: 5a597bf

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 23 packages

Name	Type
@clerk/shared	Minor
@clerk/clerk-js	Minor
@clerk/ui	Minor
@clerk/localizations	Minor
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo-passkeys	Patch
@clerk/expo	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/mosaic	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/swingset	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 13, 2026 2:23pm UTC
swingset	Ready	Preview	Oct 13, 2026 2:23pm UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10206

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10206

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10206

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10206

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10206

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10206

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10206

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10206

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10206

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10206

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10206

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10206

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10206

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10206

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10206

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10206

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10206

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10206

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10206

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10206

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10206

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10206

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10206

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10206

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10206

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10206

commit: 5a597bf

[gabrielmeloc22]

closing for now, we're restructuring this around the Consensus flow (no orgs). branch stays around