github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8463] feat(sso): add additionalData support to SSO sign in #7993

New Issue
Open
opened 2026-03-13 13:56:03 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:56:03 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/8463
Author: @rae-fcm
Created: 3/6/2026
Status: 🔄 Open

Base: canary ← Head: feat/sso-additional-data-pipeline

📝 Commits (10+)

  • e63b3dc feat(sso): pipe additional data through sso authentication flow
  • cbc44ee test(sso): add test cases for additionalData pipeline
  • 764f6dd docs: update sso docs to include additionalState parameter
  • 2711cfe Merge branch 'canary' into feat/sso-additional-data-pipeline
  • a0e3ddb feat(sso): access sso additionalData via hooks
  • 5aa3c06 chore: format & lint
  • 9614e36 Merge branch 'canary' into feat/sso-additional-data-pipeline
  • 06ef694 chore: add test cases for preventing stale user after provisioning in hooks
  • bc495a5 Merge branch 'canary' into feat/sso-additional-data-pipeline
  • 3f1cbd8 fix: correct type for sso state, parallel with OAuth state

📊 Changes

8 files changed (+775 additions, -14 deletions)

View changed files

📝 docs/content/docs/plugins/sso.mdx (+49 -1)
📝 packages/sso/src/index.ts (+1 -0)
📝 packages/sso/src/oidc.test.ts (+282 -0)
📝 packages/sso/src/routes/sso.ts (+47 -11)
📝 packages/sso/src/saml-state.ts (+1 -1)
📝 packages/sso/src/saml.test.ts (+375 -1)
➕ packages/sso/src/sso-state.ts (+16 -0)
📝 packages/sso/src/types.ts (+4 -0)

📄 Description

closes #8450

RelayState (SAML) and the OAuth state parameter (OIDC) are already used internally to carry callback URLs and other state parameters through the IdP back to the SP round-trip. additionalData exposes the same mechanism to consumers in its most general sense, allowing arbitrary key/value data to be sent with the sign-in request, echoed back by the IdP, and delivered to the provisionUser callback and sso callback hooks without any extra round-trips or storage.

Summary by cubic

Adds client-supplied additionalData to SSO sign-in and carries it through OIDC and SAML (including ACS) to provisionUser. Exposes request-scoped SSO state to hooks via getSSOState (returns null outside SSO callbacks) and re-fetches the user after provisioning to avoid stale data in org provisioning.

  • New Features

    • signIn.sso and server signInSSO accept additionalData and persist it via OAuth state and SAML RelayState (including ACS), delivering it to provisionUser.
    • getSSOState returns the full request SSO state (e.g., callbackURL, expiresAt, codeVerifier) plus additionalData for server hooks during OIDC and SAML callbacks.

  • Bug Fixes

    • Re-fetch the user after provisionUser and pass the updated user to org provisioning hooks to prevent stale role assignment (OIDC and SAML, including ACS).

Written for commit 053dc90627. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/8463 **Author:** [@rae-fcm](https://github.com/rae-fcm) **Created:** 3/6/2026 **Status:** 🔄 Open **Base:** `canary` ← **Head:** `feat/sso-additional-data-pipeline` --- ### 📝 Commits (10+) - [`e63b3dc`](https://github.com/better-auth/better-auth/commit/e63b3dc8f5bca2257d25b8635e01a122583b0b29) feat(sso): pipe additional data through sso authentication flow - [`cbc44ee`](https://github.com/better-auth/better-auth/commit/cbc44eeb1b354b3ccb95f6d24660d4cb4e5f7c35) test(sso): add test cases for additionalData pipeline - [`764f6dd`](https://github.com/better-auth/better-auth/commit/764f6dd169d9319d9641d8571ca4030b0c512734) docs: update sso docs to include additionalState parameter - [`2711cfe`](https://github.com/better-auth/better-auth/commit/2711cfe0b9d5239bf9c2c95f27b90b2384976fe5) Merge branch 'canary' into feat/sso-additional-data-pipeline - [`a0e3ddb`](https://github.com/better-auth/better-auth/commit/a0e3ddb59bfc48f281120832f45de15b303bc3cb) feat(sso): access sso additionalData via hooks - [`5aa3c06`](https://github.com/better-auth/better-auth/commit/5aa3c06e88ee1ad956e75bf4a24626c5577a4705) chore: format & lint - [`9614e36`](https://github.com/better-auth/better-auth/commit/9614e365cc3bedd3e467b204196706806fe1b660) Merge branch 'canary' into feat/sso-additional-data-pipeline - [`06ef694`](https://github.com/better-auth/better-auth/commit/06ef6945867cb980473be4a06d9c88cd0fe124f4) chore: add test cases for preventing stale user after provisioning in hooks - [`bc495a5`](https://github.com/better-auth/better-auth/commit/bc495a51f11531444e7beb8de56ccfbd1c2dbb40) Merge branch 'canary' into feat/sso-additional-data-pipeline - [`3f1cbd8`](https://github.com/better-auth/better-auth/commit/3f1cbd84ba347445c8ab7453c47b08bc5e860eaa) fix: correct type for sso state, parallel with OAuth state ### 📊 Changes **8 files changed** (+775 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/sso.mdx` (+49 -1) 📝 `packages/sso/src/index.ts` (+1 -0) 📝 `packages/sso/src/oidc.test.ts` (+282 -0) 📝 `packages/sso/src/routes/sso.ts` (+47 -11) 📝 `packages/sso/src/saml-state.ts` (+1 -1) 📝 `packages/sso/src/saml.test.ts` (+375 -1) ➕ `packages/sso/src/sso-state.ts` (+16 -0) 📝 `packages/sso/src/types.ts` (+4 -0) </details> ### 📄 Description closes #8450 RelayState (SAML) and the OAuth state parameter (OIDC) are already used internally to carry callback URLs and other state parameters through the IdP back to the SP round-trip. `additionalData` exposes the same mechanism to consumers in its most general sense, allowing arbitrary key/value data to be sent with the sign-in request, echoed back by the IdP, and delivered to the provisionUser callback and sso callback hooks without any extra round-trips or storage. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds client-supplied `additionalData` to SSO sign-in and carries it through OIDC and SAML (including ACS) to `provisionUser`. Exposes request-scoped SSO state to hooks via `getSSOState` (returns `null` outside SSO callbacks) and re-fetches the user after provisioning to avoid stale data in org provisioning. - **New Features** - `signIn.sso` and server `signInSSO` accept `additionalData` and persist it via OAuth state and SAML RelayState (including ACS), delivering it to `provisionUser`. - `getSSOState` returns the full request SSO state (e.g., `callbackURL`, `expiresAt`, `codeVerifier`) plus `additionalData` for server hooks during OIDC and SAML callbacks. - **Bug Fixes** - Re-fetch the user after `provisionUser` and pass the updated user to org provisioning hooks to prevent stale role assignment (OIDC and SAML, including ACS). <sup>Written for commit 053dc906279f24a5a90020a10981e9ae3b5a731f. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:56:03 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#7993
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?