[PR #8805] feat(sso): support multiple IDP signing certificates #16472

New Issue

2026-04-13T10:32:07-05:00

GiteaMirror commented

2026-04-13 10:32:07 -05:00

Original Pull Request: https://github.com/better-auth/better-auth/pull/8805

State: open
Merged: No

With SAML IDPs, the metadata.xml document is live - they can rotate certificates.

When rotating certificates, there is a time when the metadata will reference signing certificates - BA currently only supports an IDP having a single signing cert, but the underlying library (samlify) does, so simply need to update the types & parsing.

This PR:

Adds the string[] type to certs
Adds tests for the parsing of multiple certs

Summary by cubic

Adds support for multiple IdP signing certificates in SAML SSO to handle certificate rotation. Accepts one or many certs, validates non-empty arrays, and returns clear errors.

New Features
- SAMLConfig.cert and SAMLConfig.idpMetadata.cert now accept string | string[] (schema enforces non-empty arrays).
- Provider read endpoint normalizes input, parses all certs, and returns samlConfig.certificate as an object for a single cert or an array for multiple; returns { error: "No certificates provided" } or { error: "Failed to parse certificate" } on errors. Tests cover multi/single parsing, SHA-256 fingerprints, and object-vs-array shape.
Migration
- No changes needed for existing single-cert configs.
- Clients should handle samlConfig.certificate being an object or an array.

^{Written for commit 9b201ab2da. Summary will update on new commits.}

**Original Pull Request:** https://github.com/better-auth/better-auth/pull/8805 **State:** open **Merged:** No --- With SAML IDPs, the metadata.xml document is live - they can rotate certificates. When rotating certificates, there is a time when the metadata will reference signing certificates - BA currently only supports an IDP having a single signing cert, but the underlying library (samlify) does, so simply need to update the types & parsing. This PR: - Adds the `string[]` type to certs - Adds tests for the parsing of multiple certs  --- ## Summary by cubic Adds support for multiple IdP signing certificates in SAML SSO to handle certificate rotation. Accepts one or many certs, validates non-empty arrays, and returns clear errors. - **New Features** - `SAMLConfig.cert` and `SAMLConfig.idpMetadata.cert` now accept `string | string[]` (schema enforces non-empty arrays). - Provider read endpoint normalizes input, parses all certs, and returns `samlConfig.certificate` as an object for a single cert or an array for multiple; returns `{ error: "No certificates provided" }` or `{ error: "Failed to parse certificate" }` on errors. Tests cover multi/single parsing, SHA-256 fingerprints, and object-vs-array shape. - **Migration** - No changes needed for existing single-cert configs. - Clients should handle `samlConfig.certificate` being an object or an array. <sup>Written for commit 9b201ab2da3a28b4970c5f91df27fa7b921d4a32. Summary will update on new commits.</sup>

GiteaMirror added the pull-request label 2026-04-13 10:32:07 -05:00

Sign in to join this conversation.

Branches Tags

docs/device-oauth-use-cases

feat/agent-feedback-endpoint

changeset-release/main

main

changeset-release/next

dependabot/github_actions/github-actions-42c4bc6a62

dependabot/npm_and_yarn/demo/electron/demo-minor-patch-b1ca80f51d

fix/oauth-provider-session-deletion

feat/scim-demo-workflow

feat/scim-active-user-link

feat/sso-provider-user-resolution

feat/identity-provider-accounts

2026-07-18/fix/expo-secure-store-async

feat/oauth-provider-remove-silence-warnings

changeset-release/release/vercel-announcement

release/vercel-announcement

2026-06-29/docs/optimize-og-images

feat/yandex-social-provider

feat/ssrf-fetch-boundary

codex/pr-10225-next-comments

fix/phone-number-disable-input

perf/router-build-once

fix/oauth-user-provisioning-fields

codex/ignore-compose-override-spellcheck

2026-06-19/fix/stripe-org-reference-scope

feat/webhooks

feat/baseurl-canonical-serving-split

feat/magic-link-expires-in

fix/esbuild-security-bump

chore/sync-main-to-next-20260615

chore/revert-10053

codex/fix-expo-sdk56-dynamic-import

refactor/oauth-provider-client-authentication-module

fix/oauth-no-store-headers

claude/slack-update-stripe-docs-consistency-8Sc0w

local/fix-invite-accept-idempotency

docs/beta-mdx-component-fallback

fix/dependabot-hono-shell-quote

codex/stateless-account-cookie-resolution

fix/admin-create-user-role-escalation

feat/oauth-provider-oidc-acr

refactor/sign-in-challenges

refactor/optional-kysely-dependency

2026-06-06/chore/kysely-changeset

copilot/fix-code-review-comment

starsling/prisma-migration-reset

2026-06-02/fix/next-cookies-defer-rsc

feat/oauth-contribution-protocol

ping-maxwell/c-ping-maxwell/fix-kysely-adapter-core-utils-string-resolution-68c5

temp/server-only-test

2026-05-31/refactor/kysely-joins-json-helpers

2026-04-29/feat/google-include-granted-scopes

2026-04-29/fix/oauth-account-scope-semantics

fix/oauth-callback-path-declarative

2026-05-31/fix/sqlite-dialect-affected-rows

fix/next-cookie-separator

2026-05-29/fix/last-login-method-cookie-prefix

feat/oauth-provider-custom-subject

ping-maxwell/c-ping-maxwell/fix-error-link-apostrophe-f89a

client-assertions-main

2026-05-15/ci/fix-sqlite-abi-mismatch

2026-05-15/fix/organization-team-add-cascade

2026-05-15/fix/parse-set-cookie-value-validation

2026-05-13/feat/captcha-wildcard-endpoints

fix/i18n-before-hook-translation

fix/disable-migration-generate

2026-05-10/fix/cookie-drain-order

2026-05-10/feat/hooks-finally

2026-05-09/fix/cookie-drain-order

2026-05-09/feat/hooks-finally

2026-05-08/feat/register-before-send

fix/stripe/subscription-data-merge

2026-05-01/chore/pnpm-v11-harden

chore/pnpm-v11

2026-04-27/fix/nextcookies-idempotent-writes

2026-04-26/fix/harden-proxy-host-validation

2026-04-26/refactor/stripe-callback-signature-cleanup

2026-04-26/fix/stripe-subscription-callback-timing

2026-04-11/fix/sveltekit-app-modules

feat/open-api-zod-contract

feat/oauth-idp-initiated-bounce

2026-04-21/fix/oauth-rfc-input-validation

fix/two-factor-identity-guard

fix/resource

feat/emailpassword-authorize

feat/oauth-provider-at-hash-v2

fix/release-grep-fallback

claude/address-review-comments-JhFLr

feat/async-auth

fix/two-factor-totp-verified-enrollment

feat/plugin-ui

codex/blog-1-6-release-post

2026-04-06/fix/type-any-guards

2026-04-05/chore/downgrade-better-call

2026-04-04/ci/skip-vercel-fork-prs

2026-03-28/ci/add-autofix-ci

chore/release-preview-script

himself65/2026/02/19/role

2026-03-20/docs/improve-website

2026-03-20/fix/anonymous-onlinkaccount-expo

2026-02-17/fix/anonymous-link-state

fix/8607-saml-inresponseto

fix/8549-scim-patch-noop

v1.4.x

refactor/migration-snapshot-tests

worktree-magic-link-additional-data

chore/migrate-build-to-rollup

worktree-fix-dynamic-baseurl-8447

2026-03-06/chore/public-api-check

fix/close-8156-regression-test

fix/secondary-storage-json-error-handling

himself65/verification-namespace

cursor/issue-8307-validation-79a3

himself65/2026/01/30/error-mdx

v1.4.x-staging

fix/email-otp-user

fix/restrict-full-organization-access-roles

himself65/2026/02/12/count

himself65/2026/02/04/define-plugin

2026-02-04/feat/add-pluralize

cursor/better-auth-js-integration-ec21

cursor/expo-state-mismatch-394c

2026-02-01/fix/org-update-role-sync-members

cursor/issue-7607-investigation-e146

cursor/email-generation-helper-0ff6

himself65/2026/01/21/avoid-spread-operator

himself65/2026/01/14/cli

claude/slack-add-docs-pr-NMvgO

claude/slack-add-advanced-useplural-WHKYL

feat/hooks-pos

feat/2fa-phone

feat/2fa

fix/rotation

fix/username-check

v1.3.x

refactor/organization

feat/multiple-client-ids-social-providers

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/better-auth#16472