github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 14:21:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #4764] [CLOSED] feat(sso): Multi Tenant - use the provider domain for redirect and tokenResponse #5569

New Issue
Closed
opened 2026-03-13 12:27:54 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:27:54 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/4764
Author: @KaiSoellch
Created: 9/19/2025
Status: ❌ Closed

Base: canary ← Head: canary

📝 Commits (10+)

  • edc6978 feat(SSOOptions): add useProviderDomain option for dynamic callback URL for flexible tenant handling
  • e4450a6 feat(SSOOptions): add useProviderDomain option for callback URL customization
  • e74def2 feat(SSOOptions): enhance provider domain handling with constructProviderDomainURL function and useHttps option
  • 0a9a820 feat(CHANGELOG): update for version 1.3.5 with new features and bug fixes
  • 7b37e66 doc(SSOOptions): add useHttps option for provider domain configuration and enhance callback URL handling
  • 8440a6f fix(SSOOptions): useHttps as default, update useHttps description to clarify default behavior and ensure consistent handling in constructProviderDomainURL
  • db049b7 Merge branch 'canary' of https://github.com/better-auth/better-auth into canary
  • b45b115 Merge branch 'canary' into canary
  • fde9fe0 feat(sso): extend ssoProvider schema with customizable fields and additionalFields support
  • 6e21fc4 Merge branch 'canary' into feat-sso-additional-fields

📊 Changes

8 files changed (+652 additions, -129 deletions)

View changed files

📝 docs/content/docs/plugins/sso.mdx (+61 -1)
📝 packages/better-auth/src/plugins/sso/index.ts (+19 -41)
➕ packages/better-auth/src/plugins/sso/schema.ts (+48 -0)
📝 packages/better-auth/src/plugins/sso/sso.test.ts (+59 -72)
📝 packages/better-auth/tsconfig.json (+2 -1)
📝 packages/sso/src/index.ts (+83 -4)
📝 pnpm-lock.yaml (+358 -9)
📝 tsconfig.json (+22 -1)

📄 Description

Feature for SSO Plugin

Optional use of provider (authorization) domain for redirect and token response endpoints to support white‑label / custom CNAME auth domains.

Problem Currently the library always builds redirect (authorization) and token/introspection/revocation endpoints from the baseURL. For SaaS tenants using custom CNAME (white‑label) domains this breaks auth flows when the identity provider expects the provider (issuer) domain instead of the tenant vanity domain. This limits multi-tenant + custom domain adoption.

Summary Introduce a configurable option to resolve redirect and token-related endpoints against the provider (issuer) domain rather than the tenant (public) domain.
This allows:

  • White‑label tenant domains for end-user UX
  • correct redirecting to the provider domain for custom styles and settings

New Features

Added option: useProviderDomain to switch construction of:

  • Authorization / redirect URL
  • Token endpoint URL

Fallback

default behavior unchanged when option is absent or false.

Backward Compatibility

Fully backward compatible: existing integrations continue without changes.
No breaking type changes; option is additive.

Summary by cubic

Adds an option to build SSO redirect and token endpoints using the provider’s domain. This fixes auth flows for white‑label/custom CNAME tenants without changing defaults.

  • New Features
    • Added SSOOptions.useProviderDomain (default false) to resolve the authorization URL, callback URI, and token requests against https://{provider.domain}/api/auth.
    • Default behavior remains unchanged when not set.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/4764 **Author:** [@KaiSoellch](https://github.com/KaiSoellch) **Created:** 9/19/2025 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `canary` --- ### 📝 Commits (10+) - [`edc6978`](https://github.com/better-auth/better-auth/commit/edc69789a11d4fc6854891404d98f307db89058a) feat(SSOOptions): add useProviderDomain option for dynamic callback URL for flexible tenant handling - [`e4450a6`](https://github.com/better-auth/better-auth/commit/e4450a6a51f64eee821185e82d735f62061ccab6) feat(SSOOptions): add useProviderDomain option for callback URL customization - [`e74def2`](https://github.com/better-auth/better-auth/commit/e74def29ae494848d0516c4ca436bf59eccc866b) feat(SSOOptions): enhance provider domain handling with constructProviderDomainURL function and useHttps option - [`0a9a820`](https://github.com/better-auth/better-auth/commit/0a9a8201b9328596f028d4a371687aa743eb0ca0) feat(CHANGELOG): update for version 1.3.5 with new features and bug fixes - [`7b37e66`](https://github.com/better-auth/better-auth/commit/7b37e66398bf4cf11b1063f246087846806226a8) doc(SSOOptions): add useHttps option for provider domain configuration and enhance callback URL handling - [`8440a6f`](https://github.com/better-auth/better-auth/commit/8440a6fb901e22eadfdd3724f2d112144b5526fe) fix(SSOOptions): useHttps as default, update useHttps description to clarify default behavior and ensure consistent handling in constructProviderDomainURL - [`db049b7`](https://github.com/better-auth/better-auth/commit/db049b7285aa85158a2064a37aa4e7ebee79d0b9) Merge branch 'canary' of https://github.com/better-auth/better-auth into canary - [`b45b115`](https://github.com/better-auth/better-auth/commit/b45b1150ac3e75d282529d853e346b90e3c2fba1) Merge branch 'canary' into canary - [`fde9fe0`](https://github.com/better-auth/better-auth/commit/fde9fe094d9265b54e06ac7ff6aa06d1ce770fc7) feat(sso): extend ssoProvider schema with customizable fields and additionalFields support - [`6e21fc4`](https://github.com/better-auth/better-auth/commit/6e21fc401d781c597e8296f827d3f6920e7b4a38) Merge branch 'canary' into feat-sso-additional-fields ### 📊 Changes **8 files changed** (+652 additions, -129 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/sso.mdx` (+61 -1) 📝 `packages/better-auth/src/plugins/sso/index.ts` (+19 -41) ➕ `packages/better-auth/src/plugins/sso/schema.ts` (+48 -0) 📝 `packages/better-auth/src/plugins/sso/sso.test.ts` (+59 -72) 📝 `packages/better-auth/tsconfig.json` (+2 -1) 📝 `packages/sso/src/index.ts` (+83 -4) 📝 `pnpm-lock.yaml` (+358 -9) 📝 `tsconfig.json` (+22 -1) </details> ### 📄 Description # Feature for SSO Plugin Optional use of provider (authorization) domain for redirect and token response endpoints to support white‑label / custom CNAME auth domains. Problem Currently the library always builds redirect (authorization) and token/introspection/revocation endpoints from the baseURL. For SaaS tenants using custom CNAME (white‑label) domains this breaks auth flows when the identity provider expects the provider (issuer) domain instead of the tenant vanity domain. This limits multi-tenant + custom domain adoption. Summary Introduce a configurable option to resolve redirect and token-related endpoints against the provider (issuer) domain rather than the tenant (public) domain. This allows: - White‑label tenant domains for end-user UX - correct redirecting to the provider domain for custom styles and settings ## New Features Added option: **useProviderDomain** to switch construction of: - Authorization / redirect URL - Token endpoint URL ## Fallback default behavior unchanged when option is absent or false. ## Backward Compatibility Fully backward compatible: existing integrations continue without changes. No breaking type changes; option is additive. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds an option to build SSO redirect and token endpoints using the provider’s domain. This fixes auth flows for white‑label/custom CNAME tenants without changing defaults. - **New Features** - Added SSOOptions.useProviderDomain (default false) to resolve the authorization URL, callback URI, and token requests against https://{provider.domain}/api/auth. - Default behavior remains unchanged when not set. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:27:54 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#5569
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?