From 2ac8e5d312c499b9c6b9d2abf1a77bbbb40ab0cf Mon Sep 17 00:00:00 2001
From: Alex Yang <himself65@outlook.com>
Date: Mon, 16 Mar 2026 19:57:00 -0700
Subject: [PATCH] fix(sso): read SAML InResponseTo from correct path (#8607)

samlify's extractor nests InResponseTo under `extract.response`, not
directly on `extract`. The two login handlers (callbackSSOSAML and
acsEndpoint) were reading `extract.inResponseTo` which is always
undefined, causing InResponseTo validation to always fail. The logout
handler already used the correct path `extract?.response?.inResponseTo`.

Updated SAMLAssertionExtract interface to include the `response` property
with proper typing instead of casting to `any`.
---
 packages/sso/src/routes/sso.ts | 10 ++++------
 packages/sso/src/types.ts      |  4 +++-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/packages/sso/src/routes/sso.ts b/packages/sso/src/routes/sso.ts
index bad821fd56..e26d0c3fcb 100644
--- a/packages/sso/src/routes/sso.ts
+++ b/packages/sso/src/routes/sso.ts
@@ -2173,9 +2173,8 @@ export const callbackSSOSAML = (options?: SSOOptions) => {
 				logger: ctx.context.logger,
 			});
 
-			const inResponseTo = (extract as SAMLAssertionExtract).inResponseTo as
-				| string
-				| undefined;
+			const inResponseTo = (extract as SAMLAssertionExtract).response
+				?.inResponseTo;
 			const shouldValidateInResponseTo =
 				options?.saml?.enableInResponseToValidation;
 
@@ -2689,9 +2688,8 @@ export const acsEndpoint = (options?: SSOOptions) => {
 				logger: ctx.context.logger,
 			});
 
-			const inResponseToAcs = (extract as SAMLAssertionExtract).inResponseTo as
-				| string
-				| undefined;
+			const inResponseToAcs = (extract as SAMLAssertionExtract).response
+				?.inResponseTo;
 			const shouldValidateInResponseToAcs =
 				options?.saml?.enableInResponseToValidation;
 
diff --git a/packages/sso/src/types.ts b/packages/sso/src/types.ts
index 1fb20e79d2..7d06c1a0f3 100644
--- a/packages/sso/src/types.ts
+++ b/packages/sso/src/types.ts
@@ -99,11 +99,13 @@ export interface SAMLSessionRecord {
 export interface SAMLAssertionExtract {
 	nameID?: string;
 	sessionIndex?: string;
-	inResponseTo?: string;
 	conditions?: {
 		notBefore?: string;
 		notOnOrAfter?: string;
 	};
+	response?: {
+		inResponseTo?: string;
+	};
 }
 
 type BaseSSOProvider = {