better_auth-sso 0.6.2 → 0.8.0

data/lib/better_auth/sso/plugin/providers.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_register_provider_endpoint(config = {})
+      Endpoint.new(path: "/sso/register", method: "POST") do |ctx|
+        session = Routes.current_session(ctx)
+        body = normalize_hash(ctx.body)
+        provider_id = body[:provider_id].to_s
+        raise APIError.new("BAD_REQUEST", message: "providerId is required") if provider_id.empty?
+
+        limit = sso_provider_limit(session.fetch(:user), config)
+        if limit.to_i.zero?
+          raise APIError.new("FORBIDDEN", message: "SSO provider registration is disabled")
+        end
+        providers = ctx.context.adapter.find_many(model: "ssoProvider", where: [{field: "userId", value: session.fetch(:user).fetch("id")}])
+        if providers.length >= limit.to_i
+          raise APIError.new("FORBIDDEN", message: "You have reached the maximum number of SSO providers")
+        end
+
+        sso_validate_url!(body[:issuer], "Invalid issuer. Must be a valid URL")
+        sso_validate_organization_membership!(ctx, session.fetch(:user).fetch("id"), body[:organization_id]) if body[:organization_id]
+        if ctx.context.adapter.find_one(model: "ssoProvider", where: [{field: "providerId", value: provider_id}])
+          raise APIError.new("UNPROCESSABLE_ENTITY", message: "SSO provider with this providerId already exists")
+        end
+
+        oidc_config = normalize_hash(body[:oidc_config] || {})
+        oidc_config = sso_hydrate_oidc_config(body[:issuer], oidc_config, ctx) if oidc_config.any? && !oidc_config[:skip_discovery]
+        oidc_config[:override_user_info] = !!(body[:override_user_info] || config[:default_override_user_info]) if oidc_config.any?
+        saml_config = normalize_hash(body[:saml_config] || {})
+        sso_validate_saml_config!(saml_config, config) unless saml_config.empty?
+
+        provider = ctx.context.adapter.create(
+          model: "ssoProvider",
+          data: {
+            providerId: provider_id,
+            issuer: body[:issuer].to_s,
+            domain: body[:domain].to_s.downcase,
+            oidcConfig: oidc_config.empty? ? nil : oidc_config,
+            samlConfig: saml_config.empty? ? nil : saml_config,
+            userId: session.fetch(:user).fetch("id"),
+            organizationId: body[:organization_id],
+            domainVerified: false
+          }
+        )
+        domain_verification_token = nil
+        if config.dig(:domain_verification, :enabled)
+          domain_verification_token = BetterAuth::Crypto.random_string(24)
+          ctx.context.internal_adapter.create_verification_value(
+            identifier: sso_domain_verification_identifier(config, provider.fetch("providerId")),
+            value: domain_verification_token,
+            expiresAt: Time.now + (7 * 24 * 60 * 60)
+          )
+        end
+        response = sso_sanitize_provider(provider, ctx.context)
+        response[:redirectURI] = sso_oidc_redirect_uri(ctx.context, provider.fetch("providerId"))
+        response[:domainVerificationToken] = domain_verification_token if domain_verification_token
+        ctx.json(response)
+      end
+    end
+
+    def sso_list_providers_endpoint
+      Endpoint.new(path: "/sso/providers", method: "GET") do |ctx|
+        session = Routes.current_session(ctx)
+        providers = ctx.context.adapter.find_many(model: "ssoProvider")
+          .select { |provider| sso_provider_access?(provider, session.fetch(:user).fetch("id"), ctx) }
+          .map { |provider| sso_sanitize_provider(provider, ctx.context) }
+        ctx.json({providers: providers})
+      end
+    end
+
+    def sso_get_provider_endpoint
+      Endpoint.new(path: "/sso/get-provider", method: "GET") do |ctx|
+        session = Routes.current_session(ctx)
+        provider = sso_find_provider!(ctx, sso_fetch(ctx.query, :provider_id) || sso_fetch(ctx.params, :provider_id))
+        raise APIError.new("FORBIDDEN", message: "You don't have access to this provider") unless sso_provider_access?(provider, session.fetch(:user).fetch("id"), ctx)
+
+        ctx.json(sso_sanitize_provider(provider, ctx.context))
+      end
+    end
+
+    def sso_update_provider_endpoint(config = {})
+      Endpoint.new(path: "/sso/update-provider", method: "POST") do |ctx|
+        session = Routes.current_session(ctx)
+        body = normalize_hash(ctx.body)
+        provider = sso_find_provider!(ctx, sso_fetch(body, :provider_id) || sso_fetch(ctx.params, :provider_id))
+        raise APIError.new("FORBIDDEN", message: "You don't have access to this provider") unless sso_provider_access?(provider, session.fetch(:user).fetch("id"), ctx)
+
+        if !body.key?(:issuer) && !body.key?(:domain) && !body.key?(:oidc_config) && !body.key?(:saml_config)
+          raise APIError.new("BAD_REQUEST", message: "No fields provided for update")
+        end
+        sso_validate_url!(body[:issuer], "Invalid issuer. Must be a valid URL") if body.key?(:issuer)
+        update = {}
+        update[:issuer] = body[:issuer] if body.key?(:issuer)
+        update[:domain] = body[:domain].to_s.downcase if body.key?(:domain)
+        update[:domainVerified] = false if body.key?(:domain) && body[:domain].to_s.downcase != provider["domain"].to_s
+        if body.key?(:oidc_config)
+          current = sso_provider_config_hash(provider["oidcConfig"])
+          raise APIError.new("BAD_REQUEST", message: "Cannot update OIDC config for a provider that doesn't have OIDC configured") if current.empty?
+
+          resolved_issuer = update[:issuer] || current[:issuer] || provider["issuer"]
+          update[:oidcConfig] = current.merge(normalize_hash(body[:oidc_config])).merge(issuer: resolved_issuer).compact
+        end
+        if body.key?(:saml_config)
+          current = sso_provider_config_hash(provider["samlConfig"])
+          raise APIError.new("BAD_REQUEST", message: "Cannot update SAML config for a provider that doesn't have SAML configured") if current.empty?
+
+          resolved_issuer = update[:issuer] || current[:issuer] || provider["issuer"]
+          merged_saml_config = current.merge(normalize_hash(body[:saml_config])).merge(issuer: resolved_issuer).compact
+          sso_validate_saml_config!(merged_saml_config, config)
+          update[:samlConfig] = merged_saml_config
+        end
+        updated = ctx.context.adapter.update(model: "ssoProvider", where: [{field: "id", value: provider.fetch("id")}], update: update)
+        ctx.json(sso_sanitize_provider(updated, ctx.context))
+      end
+    end
+
+    def sso_delete_provider_endpoint
+      Endpoint.new(path: "/sso/delete-provider", method: "POST") do |ctx|
+        session = Routes.current_session(ctx)
+        provider = sso_find_provider!(ctx, sso_fetch(ctx.body, :provider_id) || sso_fetch(ctx.params, :provider_id))
+        raise APIError.new("FORBIDDEN", message: "You don't have access to this provider") unless sso_provider_access?(provider, session.fetch(:user).fetch("id"), ctx)
+
+        ctx.context.adapter.delete(model: "ssoProvider", where: [{field: "id", value: provider.fetch("id")}])
+        ctx.json({success: true})
+      end
+    end
+  end
+end

data/lib/better_auth/sso/plugin/saml_metadata_and_logout.rb

@@ -0,0 +1,352 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_validate_saml_config!(saml_config, plugin_config = {})
+      metadata = saml_config[:idp_metadata] || saml_config[:metadata] || saml_config[:idp_metadata_xml]
+      max_metadata_size = plugin_config.dig(:saml, :max_metadata_size) || SSO_DEFAULT_MAX_SAML_METADATA_SIZE
+      if metadata.to_s.bytesize > max_metadata_size
+        raise APIError.new("BAD_REQUEST", message: "IdP metadata exceeds maximum allowed size (#{max_metadata_size} bytes)")
+      end
+
+      if saml_config[:entry_point].to_s.empty? && saml_config[:single_sign_on_service].to_s.empty? && metadata.to_s.empty?
+        raise APIError.new("BAD_REQUEST", message: "SAML config must include entryPoint, singleSignOnService, or IdP metadata")
+      end
+      sso_validate_url!(saml_config[:entry_point], "SAML entryPoint must be a valid URL") unless saml_config[:entry_point].to_s.empty?
+      unless saml_config[:single_sign_on_service].to_s.empty?
+        sso_validate_url!(saml_config[:single_sign_on_service], "SAML singleSignOnService must be a valid URL")
+      end
+      unless saml_config[:single_logout_service].to_s.empty?
+        sso_validate_url!(saml_config[:single_logout_service], "SAML singleLogoutService must be a valid URL")
+      end
+
+      config_algorithm_xml = +""
+      unless saml_config[:signature_algorithm].to_s.empty?
+        config_algorithm_xml << "<ds:SignatureMethod Algorithm=\"#{saml_config[:signature_algorithm]}\"/>"
+      end
+      unless saml_config[:digest_algorithm].to_s.empty?
+        config_algorithm_xml << "<ds:DigestMethod Algorithm=\"#{saml_config[:digest_algorithm]}\"/>"
+      end
+      sso_validate_saml_algorithms!(
+        config_algorithm_xml,
+        on_deprecated: plugin_config.dig(:saml, :algorithms, :on_deprecated) || saml_config[:on_deprecated_algorithm] || "warn",
+        allowed_signature_algorithms: plugin_config.dig(:saml, :algorithms, :allowed_signature_algorithms) || saml_config[:allowed_signature_algorithms],
+        allowed_digest_algorithms: plugin_config.dig(:saml, :algorithms, :allowed_digest_algorithms) || saml_config[:allowed_digest_algorithms],
+        allowed_key_encryption_algorithms: plugin_config.dig(:saml, :algorithms, :allowed_key_encryption_algorithms) || saml_config[:allowed_key_encryption_algorithms],
+        allowed_data_encryption_algorithms: plugin_config.dig(:saml, :algorithms, :allowed_data_encryption_algorithms) || saml_config[:allowed_data_encryption_algorithms]
+      )
+      sso_validate_saml_algorithms!(
+        metadata.to_s,
+        on_deprecated: plugin_config.dig(:saml, :algorithms, :on_deprecated) || saml_config[:on_deprecated_algorithm] || "warn",
+        allowed_signature_algorithms: plugin_config.dig(:saml, :algorithms, :allowed_signature_algorithms) || saml_config[:allowed_signature_algorithms],
+        allowed_digest_algorithms: plugin_config.dig(:saml, :algorithms, :allowed_digest_algorithms) || saml_config[:allowed_digest_algorithms],
+        allowed_key_encryption_algorithms: plugin_config.dig(:saml, :algorithms, :allowed_key_encryption_algorithms) || saml_config[:allowed_key_encryption_algorithms],
+        allowed_data_encryption_algorithms: plugin_config.dig(:saml, :algorithms, :allowed_data_encryption_algorithms) || saml_config[:allowed_data_encryption_algorithms]
+      )
+    end
+
+    def sso_sp_metadata_xml(ctx, provider, config = {})
+      provider_id = provider.fetch("providerId")
+      saml_config = normalize_hash(provider["samlConfig"] || {})
+      explicit_metadata = saml_config.dig(:sp_metadata, :metadata)
+      return explicit_metadata unless explicit_metadata.to_s.empty?
+
+      entity_id = saml_config.dig(:sp_metadata, :entity_id) || saml_config[:audience] || provider["issuer"] || "#{ctx.context.base_url}/sso/saml2/sp/metadata?providerId=#{URI.encode_www_form_component(provider_id)}"
+      acs_url = sso_saml_acs_url(ctx, provider)
+      authn_requests_signed = !!saml_config[:authn_requests_signed]
+      want_assertions_signed = saml_config.key?(:want_assertions_signed) ? !!saml_config[:want_assertions_signed] : true
+      name_id_format = saml_config[:identifier_format].to_s.empty? ? "" : "<NameIDFormat>#{saml_config[:identifier_format]}</NameIDFormat>"
+      slo = if config.dig(:saml, :enable_single_logout)
+        location = "#{ctx.context.base_url}/sso/saml2/sp/slo/#{URI.encode_www_form_component(provider_id)}"
+        "<SingleLogoutService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"#{location}\" /><SingleLogoutService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"#{location}\" />"
+      end
+
+      "<EntityDescriptor entityID=\"#{entity_id}\"><SPSSODescriptor AuthnRequestsSigned=\"#{authn_requests_signed}\" WantAssertionsSigned=\"#{want_assertions_signed}\">#{slo}#{name_id_format}<AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"#{acs_url}\" index=\"0\" /></SPSSODescriptor></EntityDescriptor>"
+    end
+
+    def sso_saml_acs_url(ctx, provider)
+      provider_id = provider.fetch("providerId")
+      base_url = ctx.context.base_url
+      configured = normalize_hash(provider["samlConfig"] || {})[:callback_url].to_s
+      return configured if sso_saml_acs_url?(configured)
+
+      "#{base_url}/sso/saml2/sp/acs/#{URI.encode_www_form_component(provider_id)}"
+    end
+
+    def sso_saml_acs_url?(url)
+      return false if url.to_s.empty?
+
+      URI.parse(url.to_s).path.include?("/sso/saml2/sp/acs")
+    rescue
+      false
+    end
+
+    def sso_saml_idp_metadata(provider_or_config)
+      saml_config = if provider_or_config.respond_to?(:key?) && (provider_or_config.key?("samlConfig") || provider_or_config.key?(:samlConfig))
+        normalize_hash(provider_or_config["samlConfig"] || provider_or_config[:samlConfig] || {})
+      else
+        normalize_hash(provider_or_config || {})
+      end
+      idp_metadata = normalize_hash(saml_config[:idp_metadata] || {})
+      xml = idp_metadata[:metadata] || saml_config[:metadata] || saml_config[:idp_metadata_xml]
+      parsed = xml.to_s.strip.empty? ? {} : sso_parse_saml_metadata_xml(xml)
+      parsed[:entity_id] ||= idp_metadata[:entity_id] || idp_metadata[:entityID] || saml_config[:issuer]
+      parsed[:cert] ||= idp_metadata[:cert] || saml_config[:cert]
+      parsed[:single_sign_on_service] = sso_saml_metadata_services_from_config(idp_metadata[:single_sign_on_service] || saml_config[:single_sign_on_service]) if parsed[:single_sign_on_service].to_a.empty?
+      parsed[:single_logout_service] = sso_saml_metadata_services_from_config(idp_metadata[:single_logout_service] || saml_config[:single_logout_service]) if parsed[:single_logout_service].to_a.empty?
+      parsed
+    end
+
+    def sso_parse_saml_metadata_xml(xml)
+      doc = REXML::Document.new(xml.to_s)
+      root = doc.root
+      {
+        entity_id: root&.attributes&.[]("entityID"),
+        cert: sso_saml_normalize_certificate(sso_saml_metadata_first_text(doc, "X509Certificate")),
+        single_sign_on_service: sso_saml_metadata_services(doc, "SingleSignOnService"),
+        single_logout_service: sso_saml_metadata_services(doc, "SingleLogoutService")
+      }.compact
+    rescue
+      {}
+    end
+
+    def sso_saml_metadata_services(doc, element_name)
+      services = []
+      REXML::XPath.each(doc, "//*") do |element|
+        next unless element.name == element_name
+
+        services << {
+          binding: element.attributes["Binding"],
+          location: element.attributes["Location"]
+        }.compact
+      end
+      services
+    end
+
+    def sso_saml_metadata_first_text(doc, element_name)
+      REXML::XPath.each(doc, "//*") do |element|
+        return element.text.to_s.strip if element.name == element_name && !element.text.to_s.strip.empty?
+      end
+      nil
+    end
+
+    def sso_saml_metadata_services_from_config(value)
+      Array(value).filter_map do |entry|
+        data = normalize_hash(entry || {})
+        next if data[:location].to_s.empty?
+
+        {binding: data[:binding] || data[:Binding], location: data[:location] || data[:Location]}.compact
+      end
+    end
+
+    def sso_saml_preferred_service(services)
+      Array(services).find { |service| normalize_hash(service)[:binding].to_s.include?("HTTP-Redirect") } || Array(services).first
+    end
+
+    def sso_saml_normalize_certificate(value)
+      cert = value.to_s.strip
+      return nil if cert.empty?
+      return cert if cert.include?("BEGIN CERTIFICATE")
+
+      "-----BEGIN CERTIFICATE-----\n#{cert.scan(/.{1,64}/).join("\n")}\n-----END CERTIFICATE-----"
+    end
+
+    def sso_saml_callback_url(provider)
+      saml_config = normalize_hash(provider["samlConfig"] || {})
+      saml_config[:callback_url]
+    end
+
+    def sso_saml_logout_destination(provider)
+      saml_config = normalize_hash(provider["samlConfig"] || {})
+      direct = saml_config[:single_logout_service] ||
+        saml_config[:single_logout_service_url] ||
+        saml_config[:idp_slo_service_url] ||
+        saml_config[:logout_url]
+      return direct unless direct.to_s.empty?
+
+      service = sso_saml_preferred_service(sso_saml_idp_metadata(saml_config)[:single_logout_service])
+      normalize_hash(service || {})[:location]
+    end
+
+    def sso_store_saml_session(ctx, provider, assertion, session)
+      name_id = assertion[:name_id] || assertion[:nameid] || assertion[:email]
+      session_index = assertion[:session_index] || assertion[:sessionindex] || assertion[:id]
+      return if name_id.to_s.empty? || session_index.to_s.empty?
+
+      record = {
+        providerId: provider.fetch("providerId"),
+        sessionToken: session.fetch("token"),
+        userId: session.fetch("userId"),
+        nameId: name_id.to_s,
+        sessionIndex: session_index.to_s
+      }
+      expires_at = session["expiresAt"] || Time.now + (SSO_DEFAULT_ASSERTION_TTL_MS / 1000.0)
+      value = JSON.generate(record)
+      session_identifier = "#{SSO_SAML_SESSION_KEY_PREFIX}#{provider.fetch("providerId")}:#{name_id}"
+      ctx.context.internal_adapter.create_verification_value(
+        identifier: session_identifier,
+        value: value,
+        expiresAt: expires_at
+      )
+      ctx.context.internal_adapter.create_verification_value(
+        identifier: "#{SSO_SAML_SESSION_BY_ID_KEY_PREFIX}#{session.fetch("token")}",
+        value: session_identifier,
+        expiresAt: expires_at
+      )
+    end
+
+    def sso_process_saml_logout_request(ctx, provider, raw_request)
+      data = sso_parse_saml_logout_request(raw_request)
+      return data if data[:name_id].to_s.empty?
+
+      session_identifier = "#{SSO_SAML_SESSION_KEY_PREFIX}#{provider.fetch("providerId")}:#{data[:name_id]}"
+      verification = ctx.context.internal_adapter.find_verification_value(session_identifier)
+      return data unless verification
+
+      record = JSON.parse(verification.fetch("value"))
+      session_token = record["sessionToken"]
+      session_index_matches = data[:session_index].to_s.empty? || record["sessionIndex"].to_s.empty? || data[:session_index].to_s == record["sessionIndex"].to_s
+      ctx.context.internal_adapter.delete_session(session_token) if session_token && session_index_matches
+      ctx.context.internal_adapter.delete_verification_by_identifier(session_identifier)
+      ctx.context.internal_adapter.delete_verification_by_identifier("#{SSO_SAML_SESSION_BY_ID_KEY_PREFIX}#{session_token}") if session_token
+      data
+    rescue
+      {}
+    end
+
+    def sso_store_saml_logout_request(ctx, provider, request_id, config)
+      ttl_ms = (config.dig(:saml, :logout_request_ttl) || SSO_DEFAULT_LOGOUT_REQUEST_TTL_MS).to_i
+      ctx.context.internal_adapter.create_verification_value(
+        identifier: "#{SSO_SAML_LOGOUT_REQUEST_KEY_PREFIX}#{request_id}",
+        value: provider.fetch("providerId"),
+        expiresAt: Time.now + (ttl_ms / 1000.0)
+      )
+    end
+
+    def sso_process_saml_logout_response(ctx, raw_response)
+      data = sso_parse_saml_logout_response(raw_response)
+      status_code = data[:status_code]
+      if status_code && status_code != SSO_SAML_STATUS_SUCCESS
+        raise APIError.new("BAD_REQUEST", message: "Logout failed at IdP")
+      end
+
+      in_response_to = data[:in_response_to]
+      return if in_response_to.to_s.empty?
+
+      ctx.context.internal_adapter.delete_verification_by_identifier("#{SSO_SAML_LOGOUT_REQUEST_KEY_PREFIX}#{in_response_to}")
+    end
+
+    def sso_parse_saml_logout_request(raw_request)
+      xml = Base64.decode64(raw_request.to_s.gsub(/\s+/, ""))
+      {
+        id: xml[/\bID=['"]([^'"]+)['"]/, 1],
+        name_id: xml[%r{<(?:\w+:)?NameID[^>]*>([^<]+)</(?:\w+:)?NameID>}, 1],
+        session_index: xml[%r{<(?:\w+:)?SessionIndex[^>]*>([^<]+)</(?:\w+:)?SessionIndex>}, 1]
+      }
+    rescue
+      {}
+    end
+
+    def sso_validate_saml_slo_signature!(ctx, raw_message, error_message)
+      return true if !sso_fetch(ctx.body, :signature).to_s.empty? || !sso_fetch(ctx.query, :signature).to_s.empty?
+
+      xml = Base64.decode64(raw_message.to_s.gsub(/\s+/, ""))
+      return true if xml.include?("<Signature") || xml.include?(":Signature")
+
+      raise APIError.new("BAD_REQUEST", message: error_message)
+    rescue APIError
+      raise
+    rescue
+      raise APIError.new("BAD_REQUEST", message: error_message)
+    end
+
+    def sso_parse_saml_logout_response(raw_response)
+      xml = Base64.decode64(raw_response.to_s.gsub(/\s+/, ""))
+      {
+        in_response_to: xml[/\bInResponseTo=['"]([^'"]+)['"]/, 1],
+        status_code: xml[/<(?:\w+:)?StatusCode\b[^>]*\bValue=['"]([^'"]+)['"]/, 1]
+      }
+    rescue
+      {}
+    end
+
+    def sso_safe_slo_redirect_url(ctx, url, provider_id)
+      app_origin = ctx.context.base_url
+      callback_path = URI.parse("#{ctx.context.base_url}/sso/saml2/sp/slo/#{URI.encode_www_form_component(provider_id)}").path
+      value = url.to_s
+      return app_origin if value.empty?
+
+      if value.start_with?("/") && !value.start_with?("//")
+        parsed = URI.parse(value)
+        return app_origin if parsed.path == callback_path
+        return value
+      end
+
+      return app_origin unless ctx.context.trusted_origin?(value, allow_relative_paths: false)
+
+      parsed = URI.parse(value)
+      return app_origin if parsed.path == callback_path
+
+      value
+    rescue
+      app_origin
+    end
+
+    def sso_safe_saml_callback_url(ctx, url, provider_id)
+      app_origin = ctx.context.base_url
+      callback_path = URI.parse("#{ctx.context.base_url}/sso/saml2/callback/#{URI.encode_www_form_component(provider_id)}").path
+      acs_path = URI.parse("#{ctx.context.base_url}/sso/saml2/sp/acs/#{URI.encode_www_form_component(provider_id)}").path
+      value = url.to_s
+      return app_origin if value.empty?
+
+      if value.start_with?("/") && !value.start_with?("//")
+        parsed = URI.parse(value)
+        return app_origin if [callback_path, acs_path].include?(parsed.path)
+        return value
+      end
+
+      return app_origin unless ctx.context.trusted_origin?(value, allow_relative_paths: false)
+
+      parsed = URI.parse(value)
+      return app_origin if [callback_path, acs_path].include?(parsed.path)
+
+      value
+    rescue
+      app_origin
+    end
+
+    def sso_signed_saml_redirect_query(provider, query)
+      saml_config = normalize_hash(provider["samlConfig"] || {})
+      private_key = saml_config.dig(:sp_metadata, :private_key) || saml_config[:private_key] || saml_config[:sp_private_key]
+      raise APIError.new("BAD_REQUEST", message: "SAML Redirect signing requires privateKey") if private_key.to_s.empty?
+
+      sig_alg = saml_config[:signature_algorithm] ? sso_normalize_saml_signature_algorithm(saml_config[:signature_algorithm]) : XMLSecurity::Document::RSA_SHA256
+      signed = query.compact.merge(SigAlg: sig_alg)
+      signed_payload = signed.keys.map(&:to_s).select { |key| %w[SAMLRequest SAMLResponse RelayState SigAlg].include?(key) }.map { |key| [key, signed[key.to_sym] || signed[key]] }.reject { |_key, value| value.nil? }
+      signature_input = URI.encode_www_form(signed_payload)
+      signed[:Signature] = Base64.strict_encode64(OpenSSL::PKey.read(private_key).sign(sso_saml_signature_digest(sig_alg), signature_input))
+      signed
+    end
+
+    def sso_saml_signature_digest(signature_algorithm)
+      case signature_algorithm.to_s
+      when /sha512/i
+        OpenSSL::Digest.new("SHA512")
+      when /sha384/i
+        OpenSSL::Digest.new("SHA384")
+      when /sha1/i
+        OpenSSL::Digest.new("SHA1")
+      else
+        OpenSSL::Digest.new("SHA256")
+      end
+    end
+
+    def sso_saml_post_form(action, saml_param, saml_value, relay_state = nil)
+      relay_input = relay_state.to_s.empty? ? "" : "<input type=\"hidden\" name=\"RelayState\" value=\"#{CGI.escapeHTML(relay_state.to_s)}\" />"
+      html = "<!DOCTYPE html><html><body onload=\"document.forms[0].submit();\"><form method=\"POST\" action=\"#{CGI.escapeHTML(action.to_s)}\"><input type=\"hidden\" name=\"#{CGI.escapeHTML(saml_param.to_s)}\" value=\"#{CGI.escapeHTML(saml_value.to_s)}\" />#{relay_input}<noscript><input type=\"submit\" value=\"Continue\" /></noscript></form></body></html>"
+      [200, {"content-type" => "text/html"}, [html]]
+    end
+  end
+end

data/lib/better_auth/sso/plugin/saml_response.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_handle_saml_response(ctx, config = {})
+      provider = sso_find_provider!(ctx, sso_fetch(ctx.params, :provider_id))
+      relay_state = sso_fetch(ctx.body, :relay_state) || sso_fetch(ctx.query, :relay_state)
+      state = sso_parse_saml_relay_state(ctx, relay_state) || {}
+      raw_response = sso_fetch(ctx.body, :saml_response) || sso_fetch(ctx.query, :saml_response)
+      if ctx.method == "GET" && raw_response.to_s.empty?
+        session = Routes.current_session(ctx, allow_nil: true)
+        unless session
+          return sso_redirect(ctx, sso_append_error("#{ctx.context.base_url}/error", "invalid_request"))
+        end
+
+        return sso_redirect(ctx, sso_safe_saml_callback_url(ctx, relay_state || sso_saml_callback_url(provider) || "/", provider.fetch("providerId")))
+      end
+      max_response_size = config.dig(:saml, :max_response_size) || SSO_DEFAULT_MAX_SAML_RESPONSE_SIZE
+      if raw_response.to_s.bytesize > max_response_size
+        raise APIError.new("BAD_REQUEST", message: "SAML response exceeds maximum allowed size (#{max_response_size} bytes)")
+      end
+      in_response_to_error = sso_validate_saml_in_response_to(ctx, config, provider, raw_response, state)
+      return in_response_to_error if in_response_to_error
+
+      assertion = sso_parse_saml_response(raw_response, config, provider, ctx)
+      assertion[:email_verified] = false unless config[:trust_email_verified]
+      sso_validate_saml_timestamp!(sso_saml_timestamp_conditions(assertion), config)
+      sso_validate_saml_response!(config, assertion, provider, ctx)
+      assertion_id = assertion[:id] || assertion["id"] || assertion[:email]
+      replay_key = "#{SSO_SAML_USED_ASSERTION_KEY_PREFIX}#{assertion_id}"
+      if ctx.context.internal_adapter.find_verification_value(replay_key)
+        raise APIError.new("BAD_REQUEST", message: SSO_ERROR_CODES.fetch("SAML_RESPONSE_REPLAYED"))
+      end
+      ctx.context.internal_adapter.create_verification_value(identifier: replay_key, value: "used", expiresAt: sso_saml_assertion_replay_expires_at(assertion, config))
+
+      callback_url = sso_safe_saml_callback_url(ctx, state["callbackURL"] || sso_saml_callback_url(provider) || "/", provider.fetch("providerId"))
+      email = (assertion[:email] || assertion["email"]).to_s.downcase
+      if config[:disable_implicit_sign_up] && !state["requestSignUp"] && !ctx.context.internal_adapter.find_user_by_email(email)
+        return sso_redirect(ctx, sso_append_error(callback_url, "signup disabled"))
+      end
+
+      result = sso_find_or_create_user_result(ctx, provider, assertion, config)
+      return sso_redirect(ctx, sso_append_error(callback_url, result.fetch(:error))) if result[:error]
+
+      user = result.fetch(:user)
+      if config[:provision_user].respond_to?(:call) && (result.fetch(:created) || config[:provision_user_on_every_login])
+        config[:provision_user].call(user: user, userInfo: assertion, provider: provider)
+      end
+      session = ctx.context.internal_adapter.create_session(user.fetch("id"))
+      sso_store_saml_session(ctx, provider, assertion, session) if config.dig(:saml, :enable_single_logout)
+      Cookies.set_session_cookie(ctx, {session: session, user: user})
+      sso_redirect(ctx, callback_url)
+    end
+
+    def sso_find_or_create_user(ctx, provider, user_info, config = {})
+      sso_find_or_create_user_result(ctx, provider, user_info, config).fetch(:user)
+    end
+
+    def sso_find_or_create_user_result(ctx, provider, user_info, config = {})
+      user_info = normalize_hash(user_info)
+      email = user_info[:email].to_s.downcase
+      account_id = (user_info[:id] || user_info["id"]).to_s
+      provider_id = provider.fetch("providerId")
+      storage_provider_id = provider["samlConfig"] ? provider_id : "sso:#{provider_id}"
+      existing_account = account_id.empty? ? nil : (
+        ctx.context.internal_adapter.find_account_by_provider_id(account_id, provider_id) ||
+          ctx.context.internal_adapter.find_account_by_provider_id(account_id, "sso:#{provider_id}")
+      )
+      if existing_account
+        user = ctx.context.internal_adapter.find_user_by_id(existing_account.fetch("userId"))
+        created = false
+      elsif (found = ctx.context.internal_adapter.find_user_by_email(email, include_accounts: true))
+        already_linked_provider = Array(found[:accounts]).any? do |account|
+          [provider_id, "sso:#{provider_id}"].include?(account["providerId"])
+        end
+        if provider["samlConfig"]
+          return {error: "account_not_linked"} unless already_linked_provider || sso_saml_trusted_provider?(ctx, provider, email)
+        end
+
+        user = found[:user]
+        unless account_id.empty?
+          ctx.context.internal_adapter.create_account(
+            accountId: account_id,
+            providerId: storage_provider_id,
+            userId: user.fetch("id")
+          )
+        end
+        oidc_config = normalize_hash(provider["oidcConfig"] || {})
+        if oidc_config[:override_user_info] || config[:default_override_user_info]
+          update = {}
+          update[:name] = user_info[:name] if user_info.key?(:name)
+          update[:image] = user_info[:image] if user_info.key?(:image)
+          update[:emailVerified] = !!user_info[:email_verified] if user_info.key?(:email_verified)
+          user = ctx.context.internal_adapter.update_user(user.fetch("id"), update) if update.any?
+        end
+        created = false
+      else
+        created = ctx.context.internal_adapter.create_user(
+          email: email,
+          name: user_info[:name] || email,
+          emailVerified: user_info.key?(:email_verified) ? user_info[:email_verified] : false,
+          image: user_info[:image]
+        )
+        ctx.context.internal_adapter.create_account(
+          accountId: account_id.empty? ? created.fetch("id") : account_id,
+          providerId: storage_provider_id,
+          userId: created.fetch("id")
+        )
+        user = created
+        created = true
+      end
+      sso_assign_organization_membership(ctx, provider, user, config)
+      {user: user, created: created}
+    end
+
+    def sso_saml_trusted_provider?(ctx, provider, email)
+      provider_id = provider.fetch("providerId")
+      linking = ctx.context.options.account[:account_linking] || {}
+      return false if linking[:enabled] == false
+
+      trusted = Array(linking[:trusted_providers]).map(&:to_s).include?(provider_id.to_s)
+      trusted || (provider["domainVerified"] && sso_email_domain_matches?(email, provider["domain"]))
+    end
+
+    def sso_assign_organization_membership(ctx, provider, user, config)
+      organization_id = provider["organizationId"]
+      return if organization_id.to_s.empty?
+      return if config.dig(:organization_provisioning, :disabled)
+      return unless ctx.context.options.plugins.any? { |plugin| plugin.id == "organization" }
+      return if ctx.context.adapter.find_one(model: "member", where: [{field: "organizationId", value: organization_id}, {field: "userId", value: user.fetch("id")}])
+
+      role = if config.dig(:organization_provisioning, :get_role).respond_to?(:call)
+        config.dig(:organization_provisioning, :get_role).call(user: user, userInfo: {}, provider: provider)
+      else
+        config.dig(:organization_provisioning, :default_role) || config.dig(:organization_provisioning, :role) || "member"
+      end
+      ctx.context.adapter.create(model: "member", data: {organizationId: organization_id, userId: user.fetch("id"), role: role, createdAt: Time.now})
+    end
+
+    def sso_validate_saml_response!(config, assertion, provider, ctx)
+      validator = config.dig(:saml, :validate_response)
+      return unless validator.respond_to?(:call)
+      return if validator.call(response: assertion, provider: provider, context: ctx)
+
+      raise APIError.new("BAD_REQUEST", message: "Invalid SAML response")
+    end
+  end
+end