github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9117] [MERGED] refactor(sso)!: remove callbackUrl, consolidate ACS endpoint, fix SLO #25349

New Issue
Closed
opened 2026-04-15 22:50:54 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:50:54 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9117
Author: @gustavovalverde
Created: 4/11/2026
Status: ✅ Merged
Merged: 4/11/2026
Merged by: @gustavovalverde

Base: next ← Head: fix/sso-saml-model-split

📝 Commits (1)

  • 60db674 refactor(sso)!: remove callbackUrl, consolidate ACS endpoint, fix SLO

📊 Changes

14 files changed (+479 additions, -705 deletions)

View changed files

➕ .changeset/sso-saml-model-split.md (+31 -0)
📝 docs/content/docs/guides/saml-sso-with-okta.mdx (+3 -4)
📝 docs/content/docs/plugins/sso.mdx (+190 -197)
📝 packages/sso/src/domain-verification.test.ts (+0 -3)
📝 packages/sso/src/index.ts (+2 -6)
📝 packages/sso/src/providers.test.ts (+0 -7)
📝 packages/sso/src/routes/helpers.ts (+38 -29)
📝 packages/sso/src/routes/providers.ts (+0 -2)
📝 packages/sso/src/routes/saml-pipeline.ts (+11 -14)
📝 packages/sso/src/routes/schemas.ts (+0 -3)
📝 packages/sso/src/routes/sso.ts (+61 -215)
📝 packages/sso/src/saml.test.ts (+111 -209)
📝 packages/sso/src/saml/response-validation.ts (+5 -10)
📝 packages/sso/src/types.ts (+27 -6)

📄 Description

Summary

Separates SAML protocol concerns from application concerns by removing the dual-purpose callbackUrl field, consolidating two ACS endpoints into one, and fixing SLO/audience validation bugs.

  • Remove callbackUrl from SAMLConfig; ACS URL is always derived from baseURL + providerId
  • Remove /sso/saml2/callback/:providerId; merge GET handler into /sso/saml2/sp/acs/:providerId
  • Use createSP/createIdP everywhere (signInSSO, spMetadata); zero inline SP/IdP construction remaining
  • Fix SLO SessionIndex comparison (object vs string)
  • Default audience validation to SP entity ID per SAML Core section 2.5.1
  • Restore AllowCreate in AuthnRequests
  • Make spMetadata optional in type and schema
  • Remove dead fields: decryptionPvk, additionalParams, idpMetadata.entityURL, idpMetadata.redirectURL
  • Add JSDoc to SAMLConfig fields (issuer, entryPoint, cert, wantAssertionsSigned, spMetadata)

Summary by cubic

Simplifies SAML in @better-auth/sso by removing callbackUrl and consolidating ACS to /sso/saml2/sp/acs/:providerId (GET/POST). Fixes SLO SessionIndex, defaults audience to the SP entity ID, makes spMetadata optional, and removes unused fields. The SP metadata endpoint now always returns XML.

  • Refactors

    • Use createSP/createIdP in signIn.sso and spMetadata to remove inline construction.
    • Remove duplicate AuthnRequestRecord; a single shared type is used in validation.

  • Migration

    • Update your IdP ACS URL to /sso/saml2/sp/acs/:providerId and stop using /sso/saml2/callback/:providerId.
    • Remove callbackUrl from SAMLConfig; pass post-login redirects per request via signIn.sso({ callbackURL }).
    • Drop empty spMetadata: {}; metadata is auto-generated.
    • Remove unused fields: decryptionPvk, additionalParams, idpMetadata.entityURL, idpMetadata.redirectURL.
    • If you don’t set audience, ensure your IdP expects the SP issuer as the audience.
    • The SP metadata endpoint now always returns XML; remove any ?format query param.

Written for commit 60db6741ca. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9117 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/11/2026 **Status:** ✅ Merged **Merged:** 4/11/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `next` ← **Head:** `fix/sso-saml-model-split` --- ### 📝 Commits (1) - [`60db674`](https://github.com/better-auth/better-auth/commit/60db6741ca10cd99d13d9fd81f683fcce0badee3) refactor(sso)!: remove callbackUrl, consolidate ACS endpoint, fix SLO ### 📊 Changes **14 files changed** (+479 additions, -705 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/sso-saml-model-split.md` (+31 -0) 📝 `docs/content/docs/guides/saml-sso-with-okta.mdx` (+3 -4) 📝 `docs/content/docs/plugins/sso.mdx` (+190 -197) 📝 `packages/sso/src/domain-verification.test.ts` (+0 -3) 📝 `packages/sso/src/index.ts` (+2 -6) 📝 `packages/sso/src/providers.test.ts` (+0 -7) 📝 `packages/sso/src/routes/helpers.ts` (+38 -29) 📝 `packages/sso/src/routes/providers.ts` (+0 -2) 📝 `packages/sso/src/routes/saml-pipeline.ts` (+11 -14) 📝 `packages/sso/src/routes/schemas.ts` (+0 -3) 📝 `packages/sso/src/routes/sso.ts` (+61 -215) 📝 `packages/sso/src/saml.test.ts` (+111 -209) 📝 `packages/sso/src/saml/response-validation.ts` (+5 -10) 📝 `packages/sso/src/types.ts` (+27 -6) </details> ### 📄 Description ## Summary Separates SAML protocol concerns from application concerns by removing the dual-purpose `callbackUrl` field, consolidating two ACS endpoints into one, and fixing SLO/audience validation bugs. - Remove `callbackUrl` from `SAMLConfig`; ACS URL is always derived from `baseURL + providerId` - Remove `/sso/saml2/callback/:providerId`; merge GET handler into `/sso/saml2/sp/acs/:providerId` - Use `createSP`/`createIdP` everywhere (signInSSO, spMetadata); zero inline SP/IdP construction remaining - Fix SLO SessionIndex comparison (object vs string) - Default audience validation to SP entity ID per SAML Core section 2.5.1 - Restore `AllowCreate` in AuthnRequests - Make `spMetadata` optional in type and schema - Remove dead fields: `decryptionPvk`, `additionalParams`, `idpMetadata.entityURL`, `idpMetadata.redirectURL` - Add JSDoc to `SAMLConfig` fields (`issuer`, `entryPoint`, `cert`, `wantAssertionsSigned`, `spMetadata`) <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Simplifies SAML in `@better-auth/sso` by removing `callbackUrl` and consolidating ACS to `/sso/saml2/sp/acs/:providerId` (GET/POST). Fixes SLO SessionIndex, defaults audience to the SP entity ID, makes `spMetadata` optional, and removes unused fields. The SP metadata endpoint now always returns XML. - **Refactors** - Use `createSP`/`createIdP` in `signIn.sso` and `spMetadata` to remove inline construction. - Remove duplicate `AuthnRequestRecord`; a single shared type is used in validation. - **Migration** - Update your IdP ACS URL to `/sso/saml2/sp/acs/:providerId` and stop using `/sso/saml2/callback/:providerId`. - Remove `callbackUrl` from `SAMLConfig`; pass post-login redirects per request via `signIn.sso({ callbackURL })`. - Drop empty `spMetadata: {}`; metadata is auto-generated. - Remove unused fields: `decryptionPvk`, `additionalParams`, `idpMetadata.entityURL`, `idpMetadata.redirectURL`. - If you don’t set `audience`, ensure your IdP expects the SP `issuer` as the audience. - The SP metadata endpoint now always returns XML; remove any `?format` query param. <sup>Written for commit 60db6741ca10cd99d13d9fd81f683fcce0badee3. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:50:54 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25349
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?