@better-auth/sso 1.3.17 → 1.4.0-beta.1

package/dist/index.mjs

@@ -59,18 +59,8 @@ const sso = (options) => {
             });
           }
           const parsedSamlConfig = JSON.parse(provider.samlConfig);
-          const sp = parsedSamlConfig.spMetadata.metadata ? saml.ServiceProvider({
+          const sp = saml.ServiceProvider({
             metadata: parsedSamlConfig.spMetadata.metadata
-          }) : saml.SPMetadata({
-            entityID: parsedSamlConfig.spMetadata?.entityID || parsedSamlConfig.issuer,
-            assertionConsumerService: [
-              {
-                Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-                Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs/${provider.id}`
-              }
-            ],
-            wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
-            nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
           });
           return new Response(sp.getMetadata(), {
             headers: {
@@ -84,57 +74,64 @@ const sso = (options) => {
         {
           method: "POST",
           body: z.object({
-            providerId: z.string({}).describe(
-              "The ID of the provider. This is used to identify the provider during login and callback"
-            ),
-            issuer: z.string({}).describe("The issuer of the provider"),
-            domain: z.string({}).describe(
-              "The domain of the provider. This is used for email matching"
-            ),
+            providerId: z.string({}).meta({
+              description: "The ID of the provider. This is used to identify the provider during login and callback"
+            }),
+            issuer: z.string({}).meta({
+              description: "The issuer of the provider"
+            }),
+            domain: z.string({}).meta({
+              description: "The domain of the provider. This is used for email matching"
+            }),
             oidcConfig: z.object({
-              clientId: z.string({}).describe("The client ID"),
-              clientSecret: z.string({}).describe("The client secret"),
-              authorizationEndpoint: z.string({}).describe("The authorization endpoint").optional(),
-              tokenEndpoint: z.string({}).describe("The token endpoint").optional(),
-              userInfoEndpoint: z.string({}).describe("The user info endpoint").optional(),
+              clientId: z.string({}).meta({
+                description: "The client ID"
+              }),
+              clientSecret: z.string({}).meta({
+                description: "The client secret"
+              }),
+              authorizationEndpoint: z.string({}).meta({
+                description: "The authorization endpoint"
+              }).optional(),
+              tokenEndpoint: z.string({}).meta({
+                description: "The token endpoint"
+              }).optional(),
+              userInfoEndpoint: z.string({}).meta({
+                description: "The user info endpoint"
+              }).optional(),
               tokenEndpointAuthentication: z.enum(["client_secret_post", "client_secret_basic"]).optional(),
-              jwksEndpoint: z.string({}).describe("The JWKS endpoint").optional(),
+              jwksEndpoint: z.string({}).meta({
+                description: "The JWKS endpoint"
+              }).optional(),
               discoveryEndpoint: z.string().optional(),
-              scopes: z.array(z.string(), {}).describe("The scopes to request. ").optional(),
-              pkce: z.boolean({}).describe("Whether to use PKCE for the authorization flow").default(true).optional(),
-              mapping: z.object({
-                id: z.string({}).describe("Field mapping for user ID ("),
-                email: z.string({}).describe("Field mapping for email ("),
-                emailVerified: z.string({}).describe("Field mapping for email verification (").optional(),
-                name: z.string({}).describe("Field mapping for name ("),
-                image: z.string({}).describe("Field mapping for image (").optional(),
-                extraFields: z.record(z.string(), z.any()).optional()
-              }).optional()
+              scopes: z.array(z.string(), {}).meta({
+                description: "The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']"
+              }).optional(),
+              pkce: z.boolean({}).meta({
+                description: "Whether to use PKCE for the authorization flow"
+              }).default(true).optional()
             }).optional(),
             samlConfig: z.object({
-              entryPoint: z.string({}).describe("The entry point of the provider"),
-              cert: z.string({}).describe("The certificate of the provider"),
-              callbackUrl: z.string({}).describe("The callback URL of the provider"),
+              entryPoint: z.string({}).meta({
+                description: "The entry point of the provider"
+              }),
+              cert: z.string({}).meta({
+                description: "The certificate of the provider"
+              }),
+              callbackUrl: z.string({}).meta({
+                description: "The callback URL of the provider"
+              }),
               audience: z.string().optional(),
               idpMetadata: z.object({
-                metadata: z.string().optional(),
-                entityID: z.string().optional(),
-                cert: z.string().optional(),
+                metadata: z.string(),
                 privateKey: z.string().optional(),
                 privateKeyPass: z.string().optional(),
                 isAssertionEncrypted: z.boolean().optional(),
                 encPrivateKey: z.string().optional(),
-                encPrivateKeyPass: z.string().optional(),
-                singleSignOnService: z.array(
-                  z.object({
-                    Binding: z.string().describe("The binding type for the SSO service"),
-                    Location: z.string().describe("The URL for the SSO service")
-                  })
-                ).optional().describe("Single Sign-On service configuration")
+                encPrivateKeyPass: z.string().optional()
               }).optional(),
               spMetadata: z.object({
-                metadata: z.string().optional(),
-                entityID: z.string().optional(),
+                metadata: z.string(),
                 binding: z.string().optional(),
                 privateKey: z.string().optional(),
                 privateKeyPass: z.string().optional(),
@@ -148,23 +145,32 @@ const sso = (options) => {
               identifierFormat: z.string().optional(),
               privateKey: z.string().optional(),
               decryptionPvk: z.string().optional(),
-              additionalParams: z.record(z.string(), z.any()).optional(),
-              mapping: z.object({
-                id: z.string({}).describe("Field mapping for user ID ("),
-                email: z.string({}).describe("Field mapping for email ("),
-                emailVerified: z.string({}).describe("Field mapping for email verification").optional(),
-                name: z.string({}).describe("Field mapping for name ("),
-                firstName: z.string({}).describe("Field mapping for first name (").optional(),
-                lastName: z.string({}).describe("Field mapping for last name (").optional(),
-                extraFields: z.record(z.string(), z.any()).optional()
-              }).optional()
+              additionalParams: z.record(z.string(), z.any()).optional()
             }).optional(),
-            organizationId: z.string({}).describe(
-              "If organization plugin is enabled, the organization id to link the provider to"
-            ).optional(),
-            overrideUserInfo: z.boolean({}).describe(
-              "Override user info with the provider info. Defaults to false"
-            ).default(false).optional()
+            mapping: z.object({
+              id: z.string({}).meta({
+                description: "The field in the user info response that contains the id. Defaults to 'sub'"
+              }),
+              email: z.string({}).meta({
+                description: "The field in the user info response that contains the email. Defaults to 'email'"
+              }),
+              emailVerified: z.string({}).meta({
+                description: "The field in the user info response that contains whether the email is verified. defaults to 'email_verified'"
+              }).optional(),
+              name: z.string({}).meta({
+                description: "The field in the user info response that contains the name. Defaults to 'name'"
+              }),
+              image: z.string({}).meta({
+                description: "The field in the user info response that contains the image. Defaults to 'picture'"
+              }).optional(),
+              extraFields: z.record(z.string(), z.any()).optional()
+            }).optional(),
+            organizationId: z.string({}).meta({
+              description: "If organization plugin is enabled, the organization id to link the provider to"
+            }).optional(),
+            overrideUserInfo: z.boolean({}).meta({
+              description: "Override user info with the provider info. Defaults to false"
+            }).default(false).optional()
           }),
           use: [sessionMiddleware],
           metadata: {
@@ -394,7 +400,7 @@ const sso = (options) => {
                 jwksEndpoint: body.oidcConfig.jwksEndpoint,
                 pkce: body.oidcConfig.pkce,
                 discoveryEndpoint: body.oidcConfig.discoveryEndpoint || `${body.issuer}/.well-known/openid-configuration`,
-                mapping: body.oidcConfig.mapping,
+                mapping: body.mapping,
                 scopes: body.oidcConfig.scopes,
                 userInfoEndpoint: body.oidcConfig.userInfoEndpoint,
                 overrideUserInfo: ctx.body.overrideUserInfo || options?.defaultOverrideUserInfo || false
@@ -414,7 +420,7 @@ const sso = (options) => {
                 privateKey: body.samlConfig.privateKey,
                 decryptionPvk: body.samlConfig.decryptionPvk,
                 additionalParams: body.samlConfig.additionalParams,
-                mapping: body.samlConfig.mapping
+                mapping: body.mapping
               }) : null,
               organizationId: body.organizationId,
               userId: ctx.context.session.user.id,
@@ -438,21 +444,33 @@ const sso = (options) => {
         {
           method: "POST",
           body: z.object({
-            email: z.string({}).describe(
-              "The email address to sign in with. This is used to identify the issuer to sign in with"
-            ).optional(),
-            organizationSlug: z.string({}).describe("The slug of the organization to sign in with").optional(),
-            providerId: z.string({}).describe(
-              "The ID of the provider to sign in with. This can be provided instead of email or issuer"
-            ).optional(),
-            domain: z.string({}).describe("The domain of the provider.").optional(),
-            callbackURL: z.string({}).describe("The URL to redirect to after login"),
-            errorCallbackURL: z.string({}).describe("The URL to redirect to after login").optional(),
-            newUserCallbackURL: z.string({}).describe("The URL to redirect to after login if the user is new").optional(),
-            scopes: z.array(z.string(), {}).describe("Scopes to request from the provider.").optional(),
-            requestSignUp: z.boolean({}).describe(
-              "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider"
-            ).optional(),
+            email: z.string({}).meta({
+              description: "The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided"
+            }).optional(),
+            organizationSlug: z.string({}).meta({
+              description: "The slug of the organization to sign in with"
+            }).optional(),
+            providerId: z.string({}).meta({
+              description: "The ID of the provider to sign in with. This can be provided instead of email or issuer"
+            }).optional(),
+            domain: z.string({}).meta({
+              description: "The domain of the provider."
+            }).optional(),
+            callbackURL: z.string({}).meta({
+              description: "The URL to redirect to after login"
+            }),
+            errorCallbackURL: z.string({}).meta({
+              description: "The URL to redirect to after login"
+            }).optional(),
+            newUserCallbackURL: z.string({}).meta({
+              description: "The URL to redirect to after login if the user is new"
+            }).optional(),
+            scopes: z.array(z.string(), {}).meta({
+              description: "Scopes to request from the provider."
+            }).optional(),
+            requestSignUp: z.boolean({}).meta({
+              description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider"
+            }).optional(),
             providerType: z.enum(["oidc", "saml"]).optional()
           }),
           metadata: {
@@ -526,7 +544,7 @@ const sso = (options) => {
         async (ctx) => {
           const body = ctx.body;
           let { email, organizationSlug, providerId, domain } = body;
-          if (!options?.defaultSSO?.length && !email && !organizationSlug && !domain && !providerId) {
+          if (!email && !organizationSlug && !domain && !providerId) {
             throw new APIError("BAD_REQUEST", {
               message: "email, organizationSlug, domain or providerId is required"
             });
@@ -549,48 +567,23 @@ const sso = (options) => {
               return res.id;
             });
           }
-          let provider = null;
-          if (options?.defaultSSO?.length) {
-            const matchingDefault = providerId ? options.defaultSSO.find(
-              (defaultProvider) => defaultProvider.providerId === providerId
-            ) : options.defaultSSO.find(
-              (defaultProvider) => defaultProvider.domain === domain
-            );
-            if (matchingDefault) {
-              provider = {
-                issuer: matchingDefault.samlConfig?.issuer || matchingDefault.oidcConfig?.issuer || "",
-                providerId: matchingDefault.providerId,
-                userId: "default",
-                oidcConfig: matchingDefault.oidcConfig,
-                samlConfig: matchingDefault.samlConfig
-              };
-            }
-          }
-          if (!providerId && !orgId && !domain) {
-            throw new APIError("BAD_REQUEST", {
-              message: "providerId, orgId or domain is required"
-            });
-          }
-          if (!provider) {
-            provider = await ctx.context.adapter.findOne({
-              model: "ssoProvider",
-              where: [
-                {
-                  field: providerId ? "providerId" : orgId ? "organizationId" : "domain",
-                  value: providerId || orgId || domain
-                }
-              ]
-            }).then((res) => {
-              if (!res) {
-                return null;
+          const provider = await ctx.context.adapter.findOne({
+            model: "ssoProvider",
+            where: [
+              {
+                field: providerId ? "providerId" : orgId ? "organizationId" : "domain",
+                value: providerId || orgId || domain
               }
-              return {
-                ...res,
-                oidcConfig: res.oidcConfig ? JSON.parse(res.oidcConfig) : void 0,
-                samlConfig: res.samlConfig ? JSON.parse(res.samlConfig) : void 0
-              };
-            });
-          }
+            ]
+          }).then((res) => {
+            if (!res) {
+              return null;
+            }
+            return {
+              ...res,
+              oidcConfig: JSON.parse(res.oidcConfig)
+            };
+          });
           if (!provider) {
             throw new APIError("NOT_FOUND", {
               message: "No provider found for the issuer"
@@ -634,16 +627,15 @@ const sso = (options) => {
             });
           }
           if (provider.samlConfig) {
-            const parsedSamlConfig = typeof provider.samlConfig === "object" ? provider.samlConfig : JSON.parse(provider.samlConfig);
+            const parsedSamlConfig = JSON.parse(
+              provider.samlConfig
+            );
             const sp = saml.ServiceProvider({
               metadata: parsedSamlConfig.spMetadata.metadata,
               allowCreate: true
             });
             const idp = saml.IdentityProvider({
-              metadata: parsedSamlConfig.idpMetadata?.metadata,
-              entityID: parsedSamlConfig.idpMetadata?.entityID,
-              encryptCert: parsedSamlConfig.idpMetadata?.cert,
-              singleSignOnService: parsedSamlConfig.idpMetadata?.singleSignOnService
+              metadata: parsedSamlConfig.idpMetadata.metadata
             });
             const loginRequest = sp.createLoginRequest(
               idp,
@@ -702,38 +694,23 @@ const sso = (options) => {
               `${errorURL || callbackURL}?error=${error}&error_description=${error_description}`
             );
           }
-          let provider = null;
-          if (options?.defaultSSO?.length) {
-            const matchingDefault = options.defaultSSO.find(
-              (defaultProvider) => defaultProvider.providerId === ctx.params.providerId
-            );
-            if (matchingDefault) {
-              provider = {
-                ...matchingDefault,
-                issuer: matchingDefault.oidcConfig?.issuer || "",
-                userId: "default"
-              };
-            }
-          }
-          if (!provider) {
-            provider = await ctx.context.adapter.findOne({
-              model: "ssoProvider",
-              where: [
-                {
-                  field: "providerId",
-                  value: ctx.params.providerId
-                }
-              ]
-            }).then((res) => {
-              if (!res) {
-                return null;
+          const provider = await ctx.context.adapter.findOne({
+            model: "ssoProvider",
+            where: [
+              {
+                field: "providerId",
+                value: ctx.params.providerId
               }
-              return {
-                ...res,
-                oidcConfig: JSON.parse(res.oidcConfig)
-              };
-            });
-          }
+            ]
+          }).then((res) => {
+            if (!res) {
+              return null;
+            }
+            return {
+              ...res,
+              oidcConfig: JSON.parse(res.oidcConfig)
+            };
+          });
           if (!provider) {
             throw ctx.redirect(
               `${errorURL || callbackURL}/error?error=invalid_provider&error_description=provider not found`
@@ -957,31 +934,10 @@ const sso = (options) => {
         async (ctx) => {
           const { SAMLResponse, RelayState } = ctx.body;
           const { providerId } = ctx.params;
-          let provider = null;
-          if (options?.defaultSSO?.length) {
-            const matchingDefault = options.defaultSSO.find(
-              (defaultProvider) => defaultProvider.providerId === providerId
-            );
-            if (matchingDefault) {
-              provider = {
-                ...matchingDefault,
-                userId: "default",
-                issuer: matchingDefault.samlConfig?.issuer || ""
-              };
-            }
-          }
-          if (!provider) {
-            provider = await ctx.context.adapter.findOne({
-              model: "ssoProvider",
-              where: [{ field: "providerId", value: providerId }]
-            }).then((res) => {
-              if (!res) return null;
-              return {
-                ...res,
-                samlConfig: res.samlConfig ? JSON.parse(res.samlConfig) : void 0
-              };
-            });
-          }
+          const provider = await ctx.context.adapter.findOne({
+            model: "ssoProvider",
+            where: [{ field: "providerId", value: providerId }]
+          });
           if (!provider) {
             throw new APIError("NOT_FOUND", {
               message: "No provider found for the given providerId"
@@ -990,389 +946,46 @@ const sso = (options) => {
           const parsedSamlConfig = JSON.parse(
             provider.samlConfig
           );
-          const idpData = parsedSamlConfig.idpMetadata;
-          let idp = null;
-          if (!idpData?.metadata) {
-            idp = saml.IdentityProvider({
-              entityID: idpData.entityID || parsedSamlConfig.issuer,
-              singleSignOnService: [
-                {
-                  Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
-                  Location: parsedSamlConfig.entryPoint
-                }
-              ],
-              signingCert: idpData.cert || parsedSamlConfig.cert,
-              wantAuthnRequestsSigned: parsedSamlConfig.wantAssertionsSigned || false,
-              isAssertionEncrypted: idpData.isAssertionEncrypted || false,
-              encPrivateKey: idpData.encPrivateKey,
-              encPrivateKeyPass: idpData.encPrivateKeyPass
-            });
-          } else {
-            idp = saml.IdentityProvider({
-              metadata: idpData.metadata,
-              privateKey: idpData.privateKey,
-              privateKeyPass: idpData.privateKeyPass,
-              isAssertionEncrypted: idpData.isAssertionEncrypted,
-              encPrivateKey: idpData.encPrivateKey,
-              encPrivateKeyPass: idpData.encPrivateKeyPass
-            });
-          }
-          const spData = parsedSamlConfig.spMetadata;
-          const sp = saml.ServiceProvider({
-            metadata: spData?.metadata,
-            entityID: spData?.entityID || parsedSamlConfig.issuer,
-            assertionConsumerService: spData?.metadata ? void 0 : [
-              {
-                Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-                Location: parsedSamlConfig.callbackUrl
-              }
-            ],
-            privateKey: spData?.privateKey || parsedSamlConfig.privateKey,
-            privateKeyPass: spData?.privateKeyPass,
-            isAssertionEncrypted: spData?.isAssertionEncrypted || false,
-            encPrivateKey: spData?.encPrivateKey,
-            encPrivateKeyPass: spData?.encPrivateKeyPass,
-            wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
-            nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
+          const idp = saml.IdentityProvider({
+            metadata: parsedSamlConfig.idpMetadata.metadata
           });
-          let parsedResponse;
-          try {
-            const decodedResponse = Buffer.from(
-              SAMLResponse,
-              "base64"
-            ).toString("utf-8");
-            try {
-              parsedResponse = await sp.parseLoginResponse(idp, "post", {
-                body: {
-                  SAMLResponse,
-                  RelayState: RelayState || void 0
-                }
-              });
-            } catch (parseError) {
-              const nameIDMatch = decodedResponse.match(
-                /<saml2:NameID[^>]*>([^<]+)<\/saml2:NameID>/
-              );
-              if (!nameIDMatch) throw parseError;
-              parsedResponse = {
-                extract: {
-                  nameID: nameIDMatch[1],
-                  attributes: { nameID: nameIDMatch[1] },
-                  sessionIndex: {},
-                  conditions: {}
-                }
-              };
-            }
-            if (!parsedResponse?.extract) {
-              throw new Error("Invalid SAML response structure");
-            }
-          } catch (error) {
-            ctx.context.logger.error("SAML response validation failed", {
-              error,
-              decodedResponse: Buffer.from(SAMLResponse, "base64").toString(
-                "utf-8"
-              )
-            });
-            throw new APIError("BAD_REQUEST", {
-              message: "Invalid SAML response",
-              details: error instanceof Error ? error.message : String(error)
-            });
-          }
-          const { extract } = parsedResponse;
-          const attributes = extract.attributes || {};
-          const mapping = parsedSamlConfig.mapping ?? {};
-          const userInfo = {
-            ...Object.fromEntries(
-              Object.entries(mapping.extraFields || {}).map(([key, value]) => [
-                key,
-                attributes[value]
-              ])
-            ),
-            id: attributes[mapping.id || "nameID"] || extract.nameID,
-            email: attributes[mapping.email || "email"] || extract.nameID,
-            name: [
-              attributes[mapping.firstName || "givenName"],
-              attributes[mapping.lastName || "surname"]
-            ].filter(Boolean).join(" ") || attributes[mapping.name || "displayName"] || extract.nameID,
-            emailVerified: options?.trustEmailVerified && mapping.emailVerified ? attributes[mapping.emailVerified] || false : false
-          };
-          if (!userInfo.id || !userInfo.email) {
-            ctx.context.logger.error(
-              "Missing essential user info from SAML response",
-              {
-                attributes: Object.keys(attributes),
-                mapping,
-                extractedId: userInfo.id,
-                extractedEmail: userInfo.email
-              }
-            );
-            throw new APIError("BAD_REQUEST", {
-              message: "Unable to extract user ID or email from SAML response"
-            });
-          }
-          let user;
-          const existingUser = await ctx.context.adapter.findOne({
-            model: "user",
-            where: [
-              {
-                field: "email",
-                value: userInfo.email
-              }
-            ]
-          });
-          if (existingUser) {
-            user = existingUser;
-          } else {
-            user = await ctx.context.adapter.create({
-              model: "user",
-              data: {
-                email: userInfo.email,
-                name: userInfo.name,
-                emailVerified: userInfo.emailVerified,
-                createdAt: /* @__PURE__ */ new Date(),
-                updatedAt: /* @__PURE__ */ new Date()
-              }
-            });
-          }
-          const account = await ctx.context.adapter.findOne({
-            model: "account",
-            where: [
-              { field: "userId", value: user.id },
-              { field: "providerId", value: provider.providerId },
-              { field: "accountId", value: userInfo.id }
-            ]
-          });
-          if (!account) {
-            await ctx.context.adapter.create({
-              model: "account",
-              data: {
-                userId: user.id,
-                providerId: provider.providerId,
-                accountId: userInfo.id,
-                createdAt: /* @__PURE__ */ new Date(),
-                updatedAt: /* @__PURE__ */ new Date(),
-                accessToken: "",
-                refreshToken: ""
-              }
-            });
-          }
-          if (options?.provisionUser) {
-            await options.provisionUser({
-              user,
-              userInfo,
-              provider
-            });
-          }
-          if (provider.organizationId && !options?.organizationProvisioning?.disabled) {
-            const isOrgPluginEnabled = ctx.context.options.plugins?.find(
-              (plugin) => plugin.id === "organization"
-            );
-            if (isOrgPluginEnabled) {
-              const isAlreadyMember = await ctx.context.adapter.findOne({
-                model: "member",
-                where: [
-                  { field: "organizationId", value: provider.organizationId },
-                  { field: "userId", value: user.id }
-                ]
-              });
-              if (!isAlreadyMember) {
-                const role = options?.organizationProvisioning?.getRole ? await options.organizationProvisioning.getRole({
-                  user,
-                  userInfo,
-                  provider
-                }) : options?.organizationProvisioning?.defaultRole || "member";
-                await ctx.context.adapter.create({
-                  model: "member",
-                  data: {
-                    organizationId: provider.organizationId,
-                    userId: user.id,
-                    role,
-                    createdAt: /* @__PURE__ */ new Date(),
-                    updatedAt: /* @__PURE__ */ new Date()
-                  }
-                });
-              }
-            }
-          }
-          let session = await ctx.context.internalAdapter.createSession(user.id, ctx);
-          await setSessionCookie(ctx, { session, user });
-          const callbackUrl = RelayState || parsedSamlConfig.callbackUrl || ctx.context.baseURL;
-          throw ctx.redirect(callbackUrl);
-        }
-      ),
-      acsEndpoint: createAuthEndpoint(
-        "/sso/saml2/sp/acs/:providerId",
-        {
-          method: "POST",
-          params: z.object({
-            providerId: z.string().optional()
-          }),
-          body: z.object({
-            SAMLResponse: z.string(),
-            RelayState: z.string().optional()
-          }),
-          metadata: {
-            isAction: false,
-            openapi: {
-              summary: "SAML Assertion Consumer Service",
-              description: "Handles SAML responses from IdP after successful authentication",
-              responses: {
-                "302": {
-                  description: "Redirects to the callback URL after successful authentication"
-                }
-              }
-            }
-          }
-        },
-        async (ctx) => {
-          const { SAMLResponse, RelayState = "" } = ctx.body;
-          const { providerId } = ctx.params;
-          let provider = null;
-          if (options?.defaultSSO?.length) {
-            const matchingDefault = providerId ? options.defaultSSO.find(
-              (defaultProvider) => defaultProvider.providerId === providerId
-            ) : options.defaultSSO[0];
-            if (matchingDefault) {
-              provider = {
-                issuer: matchingDefault.samlConfig?.issuer || "",
-                providerId: matchingDefault.providerId,
-                userId: "default",
-                samlConfig: matchingDefault.samlConfig
-              };
-            }
-          } else {
-            provider = await ctx.context.adapter.findOne({
-              model: "ssoProvider",
-              where: [
-                {
-                  field: "providerId",
-                  value: providerId ?? "sso"
-                }
-              ]
-            }).then((res) => {
-              if (!res) return null;
-              return {
-                ...res,
-                samlConfig: res.samlConfig ? JSON.parse(res.samlConfig) : void 0
-              };
-            });
-          }
-          if (!provider?.samlConfig) {
-            throw new APIError("NOT_FOUND", {
-              message: "No SAML provider found"
-            });
-          }
-          const parsedSamlConfig = provider.samlConfig;
           const sp = saml.ServiceProvider({
-            entityID: parsedSamlConfig.spMetadata?.entityID || parsedSamlConfig.issuer,
-            assertionConsumerService: [
-              {
-                Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-                Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`
-              }
-            ],
-            wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
-            metadata: parsedSamlConfig.spMetadata?.metadata,
-            privateKey: parsedSamlConfig.spMetadata?.privateKey || parsedSamlConfig.privateKey,
-            privateKeyPass: parsedSamlConfig.spMetadata?.privateKeyPass,
-            nameIDFormat: parsedSamlConfig.identifierFormat ? [parsedSamlConfig.identifierFormat] : void 0
-          });
-          const idpData = parsedSamlConfig.idpMetadata;
-          const idp = !idpData?.metadata ? saml.IdentityProvider({
-            entityID: idpData?.entityID || parsedSamlConfig.issuer,
-            singleSignOnService: idpData?.singleSignOnService || [
-              {
-                Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
-                Location: parsedSamlConfig.entryPoint
-              }
-            ],
-            signingCert: idpData?.cert || parsedSamlConfig.cert
-          }) : saml.IdentityProvider({
-            metadata: idpData.metadata
+            metadata: parsedSamlConfig.spMetadata.metadata
           });
           let parsedResponse;
           try {
-            let decodedResponse = Buffer.from(SAMLResponse, "base64").toString(
-              "utf-8"
-            );
-            if (!decodedResponse.includes("StatusCode")) {
-              const insertPoint = decodedResponse.indexOf("</saml2:Issuer>");
-              if (insertPoint !== -1) {
-                decodedResponse = decodedResponse.slice(0, insertPoint + 14) + '<saml2:Status><saml2:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2:Status>' + decodedResponse.slice(insertPoint + 14);
-              }
-            } else if (!decodedResponse.includes("saml2:Success")) {
-              decodedResponse = decodedResponse.replace(
-                /<saml2:StatusCode Value="[^"]+"/,
-                '<saml2:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"'
-              );
-            }
-            try {
-              parsedResponse = await sp.parseLoginResponse(idp, "post", {
-                body: {
-                  SAMLResponse,
-                  RelayState: RelayState || void 0
-                }
-              });
-            } catch (parseError) {
-              const nameIDMatch = decodedResponse.match(
-                /<saml2:NameID[^>]*>([^<]+)<\/saml2:NameID>/
-              );
-              if (!nameIDMatch) throw parseError;
-              parsedResponse = {
-                extract: {
-                  nameID: nameIDMatch[1],
-                  attributes: { nameID: nameIDMatch[1] },
-                  sessionIndex: {},
-                  conditions: {}
-                }
-              };
-            }
-            if (!parsedResponse?.extract) {
-              throw new Error("Invalid SAML response structure");
+            parsedResponse = await sp.parseLoginResponse(idp, "post", {
+              body: { SAMLResponse, RelayState }
+            });
+            if (!parsedResponse) {
+              throw new Error("Empty SAML response");
             }
           } catch (error) {
-            ctx.context.logger.error("SAML response validation failed", {
-              error,
-              decodedResponse: Buffer.from(SAMLResponse, "base64").toString(
-                "utf-8"
-              )
-            });
+            ctx.context.logger.error("SAML response validation failed", error);
             throw new APIError("BAD_REQUEST", {
               message: "Invalid SAML response",
               details: error instanceof Error ? error.message : String(error)
             });
           }
           const { extract } = parsedResponse;
-          const attributes = extract.attributes || {};
-          const mapping = parsedSamlConfig.mapping ?? {};
+          const attributes = parsedResponse.extract.attributes;
+          const mapping = parsedSamlConfig?.mapping ?? {};
           const userInfo = {
             ...Object.fromEntries(
               Object.entries(mapping.extraFields || {}).map(([key, value]) => [
                 key,
-                attributes[value]
+                extract.attributes[value]
               ])
             ),
-            id: attributes[mapping.id || "nameID"] || extract.nameID,
-            email: attributes[mapping.email || "email"] || extract.nameID,
+            id: attributes[mapping.id] || attributes["nameID"],
+            email: attributes[mapping.email] || attributes["nameID"] || attributes["email"],
             name: [
-              attributes[mapping.firstName || "givenName"],
-              attributes[mapping.lastName || "surname"]
-            ].filter(Boolean).join(" ") || attributes[mapping.name || "displayName"] || extract.nameID,
-            emailVerified: options?.trustEmailVerified && mapping.emailVerified ? attributes[mapping.emailVerified] || false : false
+              attributes[mapping.firstName] || attributes["givenName"],
+              attributes[mapping.lastName] || attributes["surname"]
+            ].filter(Boolean).join(" ") || parsedResponse.extract.attributes?.displayName,
+            attributes: parsedResponse.extract.attributes,
+            emailVerified: options?.trustEmailVerified ? attributes?.[mapping.emailVerified] || false : false
           };
-          if (!userInfo.id || !userInfo.email) {
-            ctx.context.logger.error(
-              "Missing essential user info from SAML response",
-              {
-                attributes: Object.keys(attributes),
-                mapping,
-                extractedId: userInfo.id,
-                extractedEmail: userInfo.email
-              }
-            );
-            throw new APIError("BAD_REQUEST", {
-              message: "Unable to extract user ID or email from SAML response"
-            });
-          }
           let user;
           const existingUser = await ctx.context.adapter.findOne({
             model: "user",
@@ -1384,7 +997,7 @@ const sso = (options) => {
             ]
           });
           if (existingUser) {
-            const account = await ctx.context.adapter.findOne({
+            const accounts = await ctx.context.adapter.findOne({
               model: "account",
               where: [
                 { field: "userId", value: existingUser.id },
@@ -1392,7 +1005,7 @@ const sso = (options) => {
                 { field: "accountId", value: userInfo.id }
               ]
             });
-            if (!account) {
+            if (!accounts) {
               const isTrustedProvider = ctx.context.options.account?.accountLinking?.trustedProviders?.includes(
                 provider.providerId
               );
@@ -1482,8 +1095,9 @@ const sso = (options) => {
           }
           let session = await ctx.context.internalAdapter.createSession(user.id, ctx);
           await setSessionCookie(ctx, { session, user });
-          const callbackUrl = RelayState || parsedSamlConfig.callbackUrl || ctx.context.baseURL;
-          throw ctx.redirect(callbackUrl);
+          throw ctx.redirect(
+            RelayState || `${parsedSamlConfig.callbackUrl}` || `${parsedSamlConfig.issuer}`
+          );
         }
       )
     },