github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-20 20:26:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

fix(sso): allow rotating SAML IdP signing certificate with linked accounts (#11687)

Browse Source 
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com>
This commit is contained in:
Md Sufiyan Bari
2026-10-14 10:16:38 +01:00
committed by GitHub
co-authored by Gustavo Valverde
parent a878f9ab47
commit 182e92bd8a
5 changed files with 120 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/content/docs/plugins/sso.mdx
+2
View File
@@ -1101,6 +1101,8 @@ samlConfig: {
Both `samlConfig.cert` and `samlConfig.idpMetadata.cert` accept either a single PEM string or an array. When both are set, `idpMetadata.cert` wins.
Changing the certificates keeps the accounts already linked to the provider. Whoever holds the corresponding private key for a listed certificate can sign in as any of those users, so if organization admins should not be able to change certificates on their own, reject authentication-boundary changes in `guardProviderMutation`.
If your IdP publishes a metadata XML document, pass it as `idpMetadata.metadata` instead and leave `cert` unset. The certificates come from the document and rotation happens when the IdP republishes it. If a config supplies neither `cert` nor `idpMetadata.metadata`, registration fails with `CERT_SOURCE_MISSING`, since samlify has nothing to verify SAML responses against.
Applications can use `guardProviderMutation` to coordinate SSO changes with a paired directory-sync control plane. IdP entity IDs, endpoints, signing certificates, SP entity IDs, NameID formats, POST assertion-consumer URLs, and assertion-signing policy are authentication-boundary changes. If the guard blocks authentication-boundary changes while a directory is paired, unpair the directory, update the IdP trust configuration, and then re-pair it. OIDC client-secret rotation and SAML SP private-key rotation do not change the authentication boundary.