github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #7549] [SSO] idPs that WantAuthnRequestsSigned are not supported #28160

New Issue
Open
opened 2026-04-17 19:34:20 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-17 19:34:20 -05:00
Owner
Copy Link

Originally created by @mifopen on GitHub (Jan 22, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/7549

Originally assigned to: @Paola3stefania on GitHub.

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Because of two reasons:

  • you can not set SPMetadata's authnRequestsSigned = true via better-auth config. Though, you can set correct metadata xml directly but then what's the point of having it autogenerated?
  • SPMetada's privateKey aren't passed to samlify in a signInSSO (while passed in the callback, e.g.)

Current vs. Expected behavior

Current: Either ERR_METADATA_CONFLICT_REQUEST_SIGNED_FLAG or It is not a private key from the underlying libs.
Expected: No errors

What version of Better Auth are you using?

1.4.16

System info

not relevant

Which area(s) are affected? (Select all that apply)

Package

Auth config (if applicable)

Additional context

No response

Originally created by @mifopen on GitHub (Jan 22, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/7549 Originally assigned to: @Paola3stefania on GitHub. ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Because of two reasons: - you can not set SPMetadata's authnRequestsSigned = true via better-auth config. Though, you can set correct metadata xml directly but then what's the point of having it autogenerated? - SPMetada's privateKey aren't passed to samlify in a signInSSO (while passed in the callback, e.g.) ### Current vs. Expected behavior Current: Either `ERR_METADATA_CONFLICT_REQUEST_SIGNED_FLAG` or `It is not a private key` from the underlying libs. Expected: No errors ### What version of Better Auth are you using? 1.4.16 ### System info ```bash not relevant ``` ### Which area(s) are affected? (Select all that apply) Package ### Auth config (if applicable) ```typescript ``` ### Additional context _No response_
GiteaMirror added the enterprise label 2026-04-17 19:34:20 -05:00
GiteaMirror commented 2026-04-17 19:34:21 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 22, 2026):

It seems that currently, Better Auth does not support Identity Providers (IdPs) that require signed authentication requests due to limitations in configuring authnRequestsSigned to true. You can set the correct metadata XML directly, but that may defeat the purpose of auto-generating it through Better Auth. Users have encountered errors like ERR_METADATA_CONFLICT_REQUEST_SIGNED_FLAG or It is not a private key during the sign-in process without proper configuration [1].

To resolve this issue, I would recommend checking your configurations and ensuring that your SPMetadata setup aligns with the required parameters for the IdP you are using. Additionally, if you require further assistance, consider tagging members of the Better Auth team like @bekacru or @ping__ for more specific guidance.

Have you tried customizing the IdP settings in your configuration? What specific IdP are you trying to integrate?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3783625858 --> @better-auth-agent[bot] commented on GitHub (Jan 22, 2026): It seems that currently, Better Auth does not support Identity Providers (IdPs) that require signed authentication requests due to limitations in configuring `authnRequestsSigned` to true. You can set the correct metadata XML directly, but that may defeat the purpose of auto-generating it through Better Auth. Users have encountered errors like `ERR_METADATA_CONFLICT_REQUEST_SIGNED_FLAG` or `It is not a private key` during the sign-in process without proper configuration [[1]](https://www.better-auth.com/docs/plugins/sso). To resolve this issue, I would recommend checking your configurations and ensuring that your `SPMetadata` setup aligns with the required parameters for the IdP you are using. Additionally, if you require further assistance, consider tagging members of the Better Auth team like @bekacru or @ping__ for more specific guidance. Have you tried customizing the IdP settings in your configuration? What specific IdP are you trying to integrate? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-17 19:34:22 -05:00
Author
Owner
Copy Link

@mifopen commented on GitHub (Jan 22, 2026):

@Bekacru @ping__
Current workaround:

  • provide XML with SPSSODescriptor.AuthnRequestsSigned=true manually
  • patch package to include privateKey when calling saml.ServiceProvider ctor in signInSSO
<!-- gh-comment-id:3783635804 --> @mifopen commented on GitHub (Jan 22, 2026): @Bekacru @ping__ Current workaround: - provide XML with SPSSODescriptor.AuthnRequestsSigned=true manually - patch package to include privateKey when calling saml.ServiceProvider ctor in signInSSO
GiteaMirror commented 2026-04-17 19:34:22 -05:00
Author
Owner
Copy Link

@Paola3stefania commented on GitHub (Jan 22, 2026):

@mifopen this is part of broader SSO improvements we have planned. Will have a PR up soon :)

<!-- gh-comment-id:3786434508 --> @Paola3stefania commented on GitHub (Jan 22, 2026): @mifopen this is part of broader SSO improvements we have planned. Will have a PR up soon :)
GiteaMirror commented 2026-04-17 19:34:22 -05:00
Author
Owner
Copy Link

@gustavovalverde commented on GitHub (Apr 14, 2026):

Related in the same area (not duplicates): #7957, #6610.

<!-- gh-comment-id:4244778619 --> @gustavovalverde commented on GitHub (Apr 14, 2026): Related in the same area (not duplicates): #7957, #6610.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enterprise
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28160
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?