github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6456] [MERGED] SSO-OIDC full discovery - phase 2 #23578

New Issue
Closed
opened 2026-04-15 21:50:27 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 21:50:27 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6456
Author: @Paola3stefania
Created: 12/1/2025
Status: ✅ Merged
Merged: 12/8/2025
Merged by: @Bekacru

Base: feat/sso-oidc-discovery ← Head: feat/sso-oidc-discovery-phase-2

📝 Commits (10+)

  • e7b9125 feat(sso): integrate OIDC discovery into provider registration
  • 6294701 feat: add docu
  • dc6383b fix: default case
  • 9322fff Merge branch 'feat/sso-oidc-discovery' into feat/sso-oidc-discovery-phase-2
  • 1a0f8ea Merge branch 'feat/sso-oidc-discovery' into feat/sso-oidc-discovery-phase-2
  • 5046b00 Merge branch 'feat/sso-oidc-discovery' into feat/sso-oidc-discovery-phase-2
  • a481b66 docs: use APImethod
  • f5049ee Merge remote-tracking branch 'upstream/canary' into feat/sso-oidc-discovery-phase-2
  • 1765c28 Merge remote-tracking branch 'upstream/canary' into feat/sso-oidc-discovery-phase-2
  • 25278cb Merge branch 'feat/sso-oidc-discovery' into feat/sso-oidc-discovery-phase-2

📊 Changes

5 files changed (+423 additions, -23 deletions)

View changed files

📝 docs/content/docs/plugins/sso.mdx (+111 -0)
📝 packages/sso/src/oidc.test.ts (+167 -0)
➕ packages/sso/src/oidc/errors.ts (+86 -0)
📝 packages/sso/src/oidc/index.ts (+2 -0)
📝 packages/sso/src/routes/sso.ts (+57 -23)

📄 Description

Summary by cubic

Add automatic OIDC discovery to SSO provider registration. We fetch and validate the IdP’s .well-known config, hydrate missing endpoints, and return structured errors. Most OIDC endpoint fields become optional.

  • New Features

    • Discovery pipeline: compute discovery URL, validate URL, fetch with 10s timeout, validate issuer and required fields, select token auth method.
    • Supported token auth methods: client_secret_basic and client_secret_post; clear error when IdP only advertises unsupported methods.
    • Registration uses discovery and persists hydrated config; user values override discovered values.
    • Structured DiscoveryError codes mapped to APIError (400/502) for clear failures.
    • Docs updated with discovery flow, error codes, and override guidance.
    • Comprehensive tests for discovery, error handling, and registration paths.

  • Migration

    • No breaking changes; existing providers keep working.
    • New providers can omit authorization/token/jwks endpoints; set issuer and client credentials.
    • If your IdP advertises unsupported token auth methods, set tokenEndpointAuthentication to client_secret_basic or client_secret_post.

Written for commit 25278cb5a9. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6456 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 12/1/2025 **Status:** ✅ Merged **Merged:** 12/8/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `feat/sso-oidc-discovery` ← **Head:** `feat/sso-oidc-discovery-phase-2` --- ### 📝 Commits (10+) - [`e7b9125`](https://github.com/better-auth/better-auth/commit/e7b91259b455ec27205e0e6d6f03a9ac4fe36521) feat(sso): integrate OIDC discovery into provider registration - [`6294701`](https://github.com/better-auth/better-auth/commit/6294701b046c2c1d245cad87888890902db1102a) feat: add docu - [`dc6383b`](https://github.com/better-auth/better-auth/commit/dc6383bce1d45044b12203a73941252bec33655a) fix: default case - [`9322fff`](https://github.com/better-auth/better-auth/commit/9322ffffbe94040fc2e8e289cf55f7cd99899d77) Merge branch 'feat/sso-oidc-discovery' into feat/sso-oidc-discovery-phase-2 - [`1a0f8ea`](https://github.com/better-auth/better-auth/commit/1a0f8ea3d99fc9d30d97de8a2a8f8a5b53d26ab7) Merge branch 'feat/sso-oidc-discovery' into feat/sso-oidc-discovery-phase-2 - [`5046b00`](https://github.com/better-auth/better-auth/commit/5046b0083bff2153aa58882b33d7b9ae071be6ac) Merge branch 'feat/sso-oidc-discovery' into feat/sso-oidc-discovery-phase-2 - [`a481b66`](https://github.com/better-auth/better-auth/commit/a481b66d6484bfb7c6257085ebe9cc57e81c3894) docs: use APImethod - [`f5049ee`](https://github.com/better-auth/better-auth/commit/f5049eebfc70022a189545d91fe54bcfa073ddf5) Merge remote-tracking branch 'upstream/canary' into feat/sso-oidc-discovery-phase-2 - [`1765c28`](https://github.com/better-auth/better-auth/commit/1765c286628cd0c85837949aad0edf926fb7391b) Merge remote-tracking branch 'upstream/canary' into feat/sso-oidc-discovery-phase-2 - [`25278cb`](https://github.com/better-auth/better-auth/commit/25278cb5a9605f93a3a758db5922223a7d7866be) Merge branch 'feat/sso-oidc-discovery' into feat/sso-oidc-discovery-phase-2 ### 📊 Changes **5 files changed** (+423 additions, -23 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/sso.mdx` (+111 -0) 📝 `packages/sso/src/oidc.test.ts` (+167 -0) ➕ `packages/sso/src/oidc/errors.ts` (+86 -0) 📝 `packages/sso/src/oidc/index.ts` (+2 -0) 📝 `packages/sso/src/routes/sso.ts` (+57 -23) </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Add automatic OIDC discovery to SSO provider registration. We fetch and validate the IdP’s .well-known config, hydrate missing endpoints, and return structured errors. Most OIDC endpoint fields become optional. - **New Features** - Discovery pipeline: compute discovery URL, validate URL, fetch with 10s timeout, validate issuer and required fields, select token auth method. - Supported token auth methods: client_secret_basic and client_secret_post; clear error when IdP only advertises unsupported methods. - Registration uses discovery and persists hydrated config; user values override discovered values. - Structured DiscoveryError codes mapped to APIError (400/502) for clear failures. - Docs updated with discovery flow, error codes, and override guidance. - Comprehensive tests for discovery, error handling, and registration paths. - **Migration** - No breaking changes; existing providers keep working. - New providers can omit authorization/token/jwks endpoints; set issuer and client credentials. - If your IdP advertises unsupported token auth methods, set tokenEndpointAuthentication to client_secret_basic or client_secret_post. <sup>Written for commit 25278cb5a9605f93a3a758db5922223a7d7866be. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 21:50:27 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#23578
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?