better-auth/.changeset/sso-saml-model-split.md

@better-auth/sso

@better-auth/sso
minor

Breaking: SAML configuration changes

callbackUrl removed from samlConfig. The ACS URL is now always derived from your baseURL and providerId. Remove callbackUrl from your SAML provider configuration. The post-login redirect destination is set per sign-in via callbackURL in signIn.sso():

await authClient.signIn.sso({
  providerId: "my-provider",
  callbackURL: "/dashboard",
});

/sso/saml2/callback/:providerId endpoint removed. Update your IdP's ACS URL to /sso/saml2/sp/acs/:providerId. This endpoint handles both GET and POST requests.

spMetadata is now optional. You no longer need to pass spMetadata: {} when registering a provider. SP metadata is auto-generated from your configuration.

Removed unused fields from SAMLConfig: decryptionPvk, additionalParams, idpMetadata.entityURL, idpMetadata.redirectURL. These were stored but never read. Remove them from your configuration if present.

Bug fixes

• Fix SLO SessionIndex matching: LogoutRequests with a SessionIndex were silently failing to delete the correct session.
• Audience validation now defaults to the SP entity ID when audience is not configured, per SAML Core section 2.5.1.
• Restore AllowCreate in AuthnRequests, required by IdPs that use JIT provisioning.
• SP metadata endpoint now reflects actual SP capabilities (encryption, signing, SLO).