github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-19 23:53:17 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

refactor(sso): remove the ACS lookup that always returned undefined

Browse Source 
processSAMLResponse asked samlify for the POST ACS with the full binding URN,
but samlify keys that lookup by short name, so it always returned undefined.
The accepted Recipient values already include the providerId ACS route and
every POST ACS declared in SP metadata.
This commit is contained in:
Gustavo Valverde
2026-10-14 10:26:36 +01:00
parent c3f11cc1a1
commit 7ac1cd336d
3 changed files with 1 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/sso/src/routes/saml-pipeline.ts
-14
View File
@@ -21,7 +21,6 @@ import {
import {
getSAMLPostAssertionConsumerServiceUrls,
hasSAMLEncryptedAssertion,
SAML_HTTP_POST_BINDING,
validateAudience,
validateInResponseTo,
validateSAMLAlgorithms,
@@ -202,19 +201,11 @@ export function getSAMLRedirectCandidates(
];
}
function toArray<T>(value: T | T[] | undefined): T[] {
if (Array.isArray(value)) {
return value;
}
return value ? [value] : [];
}
function getExpectedSAMLRecipients(
config: SAMLConfig,
baseURL: string,
providerId: string,
currentCallbackPath: string,
assertionConsumerServiceUrl: string | string[] | undefined,
): string[] {
const configuredPostAssertionConsumerServiceUrls =
getSAMLPostAssertionConsumerServiceUrls(config.spMetadata?.metadata);
@@ -223,7 +214,6 @@ function getExpectedSAMLRecipients(
currentCallbackPath,
`${baseURL}/sso/saml2/sp/acs/${providerId}`,
...configuredPostAssertionConsumerServiceUrls,
...toArray(assertionConsumerServiceUrl),
];
}
@@ -432,15 +422,11 @@ export async function processSAMLResponse(
sp.entityMeta.getEntityID(),
parsedSamlConfig.audience,
];
const assertionConsumerServiceUrl = sp.entityMeta.getAssertionConsumerService(
SAML_HTTP_POST_BINDING,
);
const expectedRecipients = getExpectedSAMLRecipients(
parsedSamlConfig,
ctx.context.baseURL,
providerId,
currentCallbackPath,
assertionConsumerServiceUrl,
);
const serviceProviderPolicy =
deriveSAMLServiceProviderPolicy(parsedSamlConfig);
packages/sso/src/saml/index.ts
-1
View File
@@ -17,7 +17,6 @@ export { resolveSigningCerts, validateCertSources } from "./cert";
export {
getSAMLPostAssertionConsumerServiceUrls,
hasSAMLEncryptedAssertion,
SAML_HTTP_POST_BINDING,
validateSAMLResponseBinding,
} from "./response-binding";
export { validateAudience, validateInResponseTo } from "./response-validation";
packages/sso/src/saml/response-binding.ts
+1 -2
View File
@@ -3,8 +3,7 @@ import { DOMParser } from "@xmldom/xmldom";
import { APIError } from "better-auth/api";
import { countAllNodes, xmlParser } from "./parser";
export const SAML_HTTP_POST_BINDING =
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
const SAML_HTTP_POST_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
const SAML_BEARER_CONFIRMATION_METHOD = "urn:oasis:names:tc:SAML:2.0:cm:bearer";
const SAML_METADATA_NAMESPACE = "urn:oasis:names:tc:SAML:2.0:metadata";