better_auth-sso 0.6.2 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +10 -0
- data/README.md +36 -2
- data/lib/better_auth/plugins/sso.rb +10 -1766
- data/lib/better_auth/sso/linking/org_assignment.rb +0 -3
- data/lib/better_auth/sso/plugin/core.rb +139 -0
- data/lib/better_auth/sso/plugin/endpoints.rb +151 -0
- data/lib/better_auth/sso/plugin/oidc_discovery.rb +75 -0
- data/lib/better_auth/sso/plugin/oidc_runtime.rb +420 -0
- data/lib/better_auth/sso/plugin/provider_utils.rb +216 -0
- data/lib/better_auth/sso/plugin/providers.rb +131 -0
- data/lib/better_auth/sso/plugin/saml_metadata_and_logout.rb +352 -0
- data/lib/better_auth/sso/plugin/saml_response.rb +150 -0
- data/lib/better_auth/sso/plugin/saml_validation_and_state.rb +183 -0
- data/lib/better_auth/sso/plugin/sign_in_and_oidc_callbacks.rb +125 -0
- data/lib/better_auth/sso/routes/schemas.rb +14 -8
- data/lib/better_auth/sso/routes/sso.rb +1 -1
- data/lib/better_auth/sso/saml_state.rb +1 -1
- data/lib/better_auth/sso/version.rb +1 -1
- metadata +27 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7aeb07725d9147d0ea71a45cd26ce3d5a8ea62668a6f20a3b52a85faa75b2a0c
|
|
4
|
+
data.tar.gz: 33904ef6ca664b29892995aa1d8acc7d18e254a31f598a1c2890fb15e1410c8c
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 60cee7f073bf639c84fc8f966524416666d8e42d71a9c62b0491b69c0825c77bf779721a38ffe4fe514aabf097c4b07f80e6c797821a0fe3d6aa42e60f3c9b01
|
|
7
|
+
data.tar.gz: 335191868b3b4d82a3dd77ea32ff3c38b37a0ff609036c402a3e1a5e2750712da8775f8f3193b105e65a2436422de94bf6708ec9ab5f049f0733124ea30d5639
|
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,15 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## Unreleased
|
|
4
|
+
|
|
5
|
+
## 0.7.0 - 2026-05-05
|
|
6
|
+
|
|
7
|
+
- Fixed SAML config validation for `singleSignOnService` and added validation for `singleLogoutService`.
|
|
8
|
+
- Hardened OIDC callbacks by binding signed state `providerId` to the callback route and verifying `nonce` on JWKS-backed ID tokens.
|
|
9
|
+
- Changed SSO domain verification to require exact TXT record matches and corrected the insufficient access error code to `INSUFFICIENT_ACCESS`.
|
|
10
|
+
- Declared `jwt` as a direct runtime dependency for the SSO gem.
|
|
11
|
+
- Added regression coverage for SAML SP metadata XML responses.
|
|
12
|
+
|
|
3
13
|
## 0.2.0 - 2026-04-29
|
|
4
14
|
|
|
5
15
|
- Improved SSO upstream parity for OIDC and SAML provider flows, organization handling, callback behavior, metadata parsing, account linking, and response/error shapes.
|
data/README.md
CHANGED
|
@@ -2,7 +2,10 @@
|
|
|
2
2
|
|
|
3
3
|
External SSO plugin package for `better_auth`.
|
|
4
4
|
|
|
5
|
-
SSO is the app-facing feature. It supports OIDC SSO
|
|
5
|
+
SSO is the app-facing feature. It supports OIDC SSO, SAML SSO, provider management,
|
|
6
|
+
domain verification, SAML replay protection, runtime OIDC discovery, organization
|
|
7
|
+
assignment, and SAML Single Logout. SAML is not the same thing as SSO; SAML is
|
|
8
|
+
one protocol used by SSO.
|
|
6
9
|
|
|
7
10
|
```ruby
|
|
8
11
|
require "better_auth"
|
|
@@ -15,7 +18,11 @@ BetterAuth.auth(
|
|
|
15
18
|
)
|
|
16
19
|
```
|
|
17
20
|
|
|
18
|
-
SAML XML validation is included in this package and backed by `ruby-saml
|
|
21
|
+
SAML XML validation is included in this package and backed by `ruby-saml`.
|
|
22
|
+
Production XML SAML deployments should configure `BetterAuth::SSO::SAML.sso_options`
|
|
23
|
+
or compatible SAML hooks so AuthnRequest generation and SAMLResponse parsing use
|
|
24
|
+
the real XML/SAML boundary instead of the lightweight JSON/base64 fallback used by
|
|
25
|
+
local tests:
|
|
19
26
|
|
|
20
27
|
```ruby
|
|
21
28
|
require "better_auth/sso"
|
|
@@ -43,3 +50,30 @@ SAML SLO follows upstream route shapes when `saml.enableSingleLogout` is enabled
|
|
|
43
50
|
Ruby keeps the lightweight JSON/base64 fallback used by the local SAML test adapter, and real XML deployments should configure `BetterAuth::SSO::SAML.sso_options` or compatible SAML hooks.
|
|
44
51
|
|
|
45
52
|
SCIM is a separate provisioning feature and lives in `better_auth-scim`.
|
|
53
|
+
|
|
54
|
+
## Organization Assignment
|
|
55
|
+
|
|
56
|
+
When the organization plugin is installed, SSO can add users to an organization
|
|
57
|
+
linked to an SSO provider. SSO login flows assign from the matched provider.
|
|
58
|
+
Generic OAuth callbacks under `/callback/:provider` also assign by verified SSO
|
|
59
|
+
email domain when domain verification is enabled, matching upstream behavior for
|
|
60
|
+
users who sign in through non-SSO OAuth but share an enterprise domain.
|
|
61
|
+
|
|
62
|
+
## Schema Compatibility
|
|
63
|
+
|
|
64
|
+
The Ruby package intentionally keeps the historical default SSO provider model
|
|
65
|
+
name `ssoProviders` for backward compatibility. Upstream Better Auth defaults to
|
|
66
|
+
`ssoProvider`; configure `model_name:` if your application needs a different
|
|
67
|
+
storage model name.
|
|
68
|
+
|
|
69
|
+
Field mapping options are supported through `fields:` for the SSO provider
|
|
70
|
+
schema, including `issuer`, `oidcConfig`, `samlConfig`, `userId`, `providerId`,
|
|
71
|
+
`organizationId`, `domain`, and `domainVerified`.
|
|
72
|
+
|
|
73
|
+
## Scope and Non-Goals
|
|
74
|
+
|
|
75
|
+
This package does not currently imply support for advanced enterprise features
|
|
76
|
+
such as `private_key_jwt`, mTLS client authentication, every SAML XML edge case,
|
|
77
|
+
or large internal SSO refactors. Those items are tracked in the
|
|
78
|
+
[upstream and product alignment backlog](../../.docs/backlog/upstream-product-alignment.md)
|
|
79
|
+
until they have explicit product scope and upstream parity decisions.
|